Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
BraveBrowserSetup-BRV002.exe

Overview

General Information

Sample name:BraveBrowserSetup-BRV002.exe
Analysis ID:1408821
MD5:e3e7498c2436a1570109fbe755af1d40
SHA1:d7fb79f465d2c87ef22088327b5bfb73899fdf7e
SHA256:498e27ed4e5bb584672992f459c0e51cd1e7345889dff1521ccf577b13ed6313
Infos:

Detection

Score:51
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:47
Range:0 - 100

Signatures

Benign windows process drops PE files
Creates an undocumented autostart registry key
Downloads suspicious files via Chrome
Found evasive API chain (may stop execution after checking volume information)
Found evasive API chain checking for user administrative privileges
Maps a DLL or memory area into another process
Changes image file execution options
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Disables exception chain validation (SEHOP)
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Potential browser exploit detected (process start blacklist hit)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Use Short Name Path in Command Line
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • BraveBrowserSetup-BRV002.exe (PID: 4228 cmdline: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe MD5: E3E7498C2436A1570109FBE755AF1D40)
    • BraveUpdate.exe (PID: 4428 cmdline: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • BraveUpdate.exe (PID: 3608 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • BraveUpdate.exe (PID: 6308 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
        • BraveUpdateComRegisterShell64.exe (PID: 5440 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" MD5: F2CA542F38E6B51EDB9790369117F54A)
        • BraveUpdateComRegisterShell64.exe (PID: 6932 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" MD5: F2CA542F38E6B51EDB9790369117F54A)
        • BraveUpdateComRegisterShell64.exe (PID: 5776 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" MD5: F2CA542F38E6B51EDB9790369117F54A)
      • BraveUpdate.exe (PID: 7036 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGOUMwOTg2Qy00NjYzLTQzNDUtQjFBNy1FQkE2Njc3OTA1RkV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RTc5NTUyNEYtOEU0Qi00RUYwLTgyOUUtOEZEQkZFODFDNTI4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI0ODI4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • BraveUpdate.exe (PID: 4476 cmdline: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{F9C0986C-4663-4345-B1A7-EBA6677905FE} MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
  • BraveUpdate.exe (PID: 1516 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
  • BraveUpdate.exe (PID: 5812 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
    • BraveUpdate.exe (PID: 6988 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
  • BraveUpdate.exe (PID: 4856 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
    • brave_installer-x64.exe (PID: 8024 cmdline: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\guiCA69.tmp MD5: 40976C35E6CA27871F134A8A2FCAFC21)
  • svchost.exe (PID: 7184 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • BraveUpdateOnDemand.exe (PID: 7288 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
    • BraveUpdate.exe (PID: 7316 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • iexplore.exe (PID: 7376 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
        • iexplore.exe (PID: 7432 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9474 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
          • ie_to_edge_stub.exe (PID: 7536 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458 MD5: 89CF8972D683795DAB6901BC9456675D)
          • ssvagent.exe (PID: 7616 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • ie_to_edge_stub.exe (PID: 7584 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458 MD5: 89CF8972D683795DAB6901BC9456675D)
          • msedge.exe (PID: 7648 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458 MD5: 69222B8101B0601CC6663F8381E7E00F)
            • msedge.exe (PID: 7908 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
            • msedge.exe (PID: 8556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6184 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
            • identity_helper.exe (PID: 9048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
            • identity_helper.exe (PID: 9068 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
        • ssvagent.exe (PID: 7632 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • iexplore.exe (PID: 8684 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75012 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
          • ssvagent.exe (PID: 8828 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • ssvagent.exe (PID: 8848 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
        • iexplore.exe (PID: 9204 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9480 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
        • iexplore.exe (PID: 8504 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:1578252 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
        • iexplore.exe (PID: 6596 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75020 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
  • BraveUpdateOnDemand.exe (PID: 8352 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
    • BraveUpdate.exe (PID: 8524 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • iexplore.exe (PID: 8652 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
      • BraveUpdateOnDemand.exe (PID: 8652 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
        • BraveUpdate.exe (PID: 8608 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
          • iexplore.exe (PID: 7636 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
  • BraveUpdateOnDemand.exe (PID: 9020 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding MD5: 088EBFFD13539DBEF1204243C3558999)
    • BraveUpdate.exe (PID: 9032 cmdline: "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand MD5: 7ACF578621988C8B80F4D7EF7A12B89F)
      • iexplore.exe (PID: 9160 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
  • msedge.exe (PID: 8428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1788,i,66099047840648098,18039867653235187412,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Use Short Name Path in Command Line
Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9474 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 7432, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 7616, ProcessName: ssvagent.exe
Sigma detected: Modification of IE Registry Settings
Source: Registry Key setAuthor: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 7376, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7184, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

barindex
Uses 32bit PE files
Source: BraveBrowserSetup-BRV002.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
PE / OLE file has a valid certificate
Source: BraveBrowserSetup-BRV002.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: BraveBrowserSetup-BRV002.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: goopdateres_unsigned_ms.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DC1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748660465.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748783702.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ms.dll.1.dr
Source: Binary string: goopdateres_unsigned_fa.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CE7000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737623769.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737479191.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ru.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E46000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752240843.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752136387.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_lt.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DB1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D8C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1745743530.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1746592148.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_el.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000347D000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C95000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735540617.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735449369.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1756132811.000000000087F000.00000004.00000020.00020000.00000000.sdmp, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_tr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036A9000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754014524.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_de.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C87000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C62000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735078370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734919338.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_de.dll.0.dr
Source: Binary string: psuser_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2372111066.00000000008C4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755436587.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_mr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035C1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748350850.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748222939.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_mr.dll.1.dr
Source: Binary string: goopdateres_unsigned_bg.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C1E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C43000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733003348.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733178204.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdbS source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731696317.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731379800.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731610280.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1763510360.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1766907880.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1765603391.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000002.1769778901.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000000.1767999510.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: goopdateres_unsigned_gu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003505000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D1D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739012890.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738930243.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_gu.dll.1.dr, goopdateres_gu.dll.0.dr
Source: Binary string: goopdateres_unsigned_th.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000369C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EB3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753847668.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E6E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752900983.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731696317.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731379800.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731610280.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1763510360.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1766907880.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1765603391.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000002.1769778901.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000000.1767999510.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: psmachine_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755667817.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755195874.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2372111066.00000000008C4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755436587.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_am.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732345477.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732249902.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\jenkins\x64-release\src\out\Release\mini_installer.exe.pdb source: brave_installer-x64.exe, 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmp, brave_installer-x64.exe, 00000031.00000000.2145638961.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmp, brave_installer-x64.exe.12.dr
Source: Binary string: goopdateres_unsigned_ta.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003680000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E97000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753507776.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ta.dll.1.dr
Source: Binary string: goopdateres_unsigned_cs.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C6C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003455000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734426603.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734335370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_cs.dll.1.dr
Source: Binary string: goopdateres_unsigned_lv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747332863.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747463488.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_lv.dll.1.dr
Source: Binary string: goopdate_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003513000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739422212.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739255907.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_hi.dll.0.dr, goopdateres_hi.dll.1.dr
Source: Binary string: goopdateres_unsigned_es-419.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CA6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CCB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737018312.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736881596.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mi_exe_stub.pdb source: BraveBrowserSetup-BRV002.exe, BraveUpdateSetup.exe.0.dr
Source: Binary string: goopdateres_unsigned_pt-BR.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750506641.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750691999.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.dr
Source: Binary string: goopdateres_unsigned_hr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D38000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D13000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739682278.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739528217.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_hr.dll.1.dr, goopdateres_hr.dll.0.dr
Source: Binary string: BraveUpdate_unsigned.pdb source: BraveUpdate.exe, BraveUpdate.exe, 00000002.00000000.1758872367.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000003.00000002.1771595446.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000006.00000002.1771903388.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000008.00000002.1773380799.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000009.00000002.1775532981.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000A.00000000.1774364093.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000B.00000000.1785977546.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000C.00000002.2382910661.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000F.00000000.1842720054.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000001D.00000002.1937800299.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000025.00000002.1975410538.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000002C.00000000.2045807918.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe.1.dr
Source: Binary string: goopdateres_unsigned_id.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D53000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000353C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740463507.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740291601.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_id.dll.0.dr
Source: Binary string: psuser_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755195874.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_zh-TW.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036EC000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2372111066.00000000008BE000.00000004.00000010.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754884888.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveCrashHandlerArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731279920.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731183450.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveCrashHandler64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730441814.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateCore_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729576252.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729944101.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729844295.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateCore.exe.1.dr
Source: Binary string: BraveCrashHandler_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730360186.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730031120.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730252432.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveCrashHandler.exe.0.dr
Source: Binary string: goopdateres_unsigned_sw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E8A000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003672000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753339647.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveCrashHandler64_unsigned.pdb~ source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730441814.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_it.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003557000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D6E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1741745508.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1741378088.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pt-PT.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003613000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750968422.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1751191588.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_pt-PT.dll.1.dr
Source: Binary string: goopdateres_unsigned_vi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036D2000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754536030.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_bn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C50000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733430885.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733591723.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_bn.dll.0.dr
Source: Binary string: goopdateres_unsigned_sv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E7C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E57000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753062470.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_sv.dll.1.dr
Source: Binary string: goopdateres_unsigned_ja.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003572000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D8A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1743498933.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1742842959.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ja.dll.0.dr
Source: Binary string: BraveUpdateBroker_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757893344.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757619314.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757809186.000000000088F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateBroker.exe.1.dr
Source: Binary string: goopdateres_unsigned_es.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000034A7000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CBE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736781422.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736699628.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_es.dll.0.dr
Source: Binary string: BraveUpdateCore_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729576252.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729944101.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729844295.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateCore.exe.1.dr
Source: Binary string: psmachine_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755885475.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_is.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D3C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D61000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740899243.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1741017579.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_is.dll.0.dr
Source: Binary string: goopdateres_unsigned_uk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002ECE000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754180457.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ro.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E38000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1751752611.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1751637703.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738591327.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738443283.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ca.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003447000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733967260.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734062343.000000000087D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_nl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035DD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DF5000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748929382.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1749115057.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1756132811.000000000087F000.00000004.00000020.00020000.00000000.sdmp, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_ko.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000358C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DA3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1745242892.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1745507066.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ko.dll.1.dr
Source: Binary string: goopdateres_unsigned_et.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737317710.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737387212.000000000087D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732005132.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731926937.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_iw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D7C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003565000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1742078642.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1742324115.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_iw.dll.0.dr
Source: Binary string: goopdateres_unsigned_ur.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EDC000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754357844.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ur.dll.0.dr
Source: Binary string: goopdateres_unsigned_te.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000368E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753673947.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_te.dll.1.dr
Source: Binary string: goopdateres_unsigned_no.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DDD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1749390758.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1749568850.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_no.dll.0.dr
Source: Binary string: goopdateres_unsigned_fil.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CDC000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738260944.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738343246.000000000087D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdate_unsigned.pdbz source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035F8000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750222290.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750026328.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_pl.dll.1.dr
Source: Binary string: goopdateres_unsigned_en-GB.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CB0000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C8B000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736052372.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736334569.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E2E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752515656.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752355678.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CCF000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CF4000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738015984.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737933319.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ml.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DCB000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DA6000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747600952.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747781562.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D21000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D46000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740087322.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740008716.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateOnDemand_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757980764.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1758250397.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1758170115.000000000088F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateOnDemand.exe, 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000000E.00000000.1842024178.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000001B.00000002.1914575441.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000001B.00000000.1907421355.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 00000024.00000000.1964220932.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 00000024.00000002.1968846412.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000002B.00000000.2043672766.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000002B.00000002.2048025475.000000000007E000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: psmachine_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755667817.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_en.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CA3000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C7D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735658873.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735826271.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000002.2341158597.00000000007E0000.00000002.00000001.00040000.0000001C.sdmp, BraveUpdate.exe, 00000002.00000002.1760857677.0000000000F80000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 00000008.00000002.1774084733.00000000012D0000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000000B.00000002.2329878557.00000000019C0000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000000C.00000002.2385973749.0000000000D40000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000000F.00000002.1845247303.0000000000B60000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000001D.00000002.1935084794.0000000000950000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 00000025.00000002.1975990062.0000000001650000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000002C.00000002.2055568647.0000000000B40000.00000002.00000001.00040000.00000009.sdmp, goopdateres_en.dll.0.dr
Source: Binary string: goopdateres_unsigned_da.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003462000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C7A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734545982.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734708345.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_da.dll.0.dr
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732005132.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731926937.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755885475.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ar.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C36000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C11000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732753472.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732468828.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ar.dll.0.dr
Source: Binary string: goopdateres_unsigned_sl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E61000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E3C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752733686.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_zh-CN.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EF6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002ED1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754711049.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_kn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D97000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1744734413.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1744417417.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AAD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00AAD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009AD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_009AD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A341D68 FindFirstFileExW,4_2_00007FF65A341D68
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_00076405 FindFirstFileExW,14_2_00076405
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Source: Joe Sandbox ViewIP Address: 204.79.197.200 204.79.197.200
Source: Joe Sandbox ViewIP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox ViewIP Address: 151.101.193.108 151.101.193.108
Source: Joe Sandbox ViewIP Address: 13.107.21.200 13.107.21.200
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C
Source: msapplication.xml1.16.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x371f6e9b,0x01da75e9</date><accdate>0x3723bc21,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000010.00000002.3586576235.0000013F48DB0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3586576235.0000013F48DB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x377ed216,0x01da75e9</date><accdate>0x377ed216,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.facebook.com/ equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.twitter.com/ equals www.twitter.com (Twitter)
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.youtube.com/ equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/favicon.icoYD equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.myspace.com/favicon.ico&D equals www.myspace.com (Myspace)
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/ equals www.rambler.ru (Rambler)
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/favicon.ico+ equals www.rambler.ru (Rambler)
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000010.00000002.3590062687.0000013F49B60000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/p equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amazon.fr/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ariadna.elmundo.es/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arianna.libero.it/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arianna.libero.it/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asp.usatoday.com/U;
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asp.usatoday.com/favicon.ico&
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://auon.jp/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://auone.jp/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://br.search.yahoo.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browse.guardian.co.uk/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.buscape.com.br/VIP;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.estadao.com.br/favicon.icojAf;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.igbusca.com.br/
Source: iexplore.exe, 00000010.00000003.1921283681.0000013F45AB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.icoY
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.orange.es/=;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/
Source: iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/favicon.icoQ
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.lycos.es/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com.br/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/i:H;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.es/w;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscar.ozu.es/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscar.ya.com/W
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busqueda.aol.com.mx/
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cerca.lycos.it/M;
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico:F
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45AB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnet.search.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922034906.0000013F45AD5000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AD6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://corp.naukri.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://corp.naukri.com/favicon.ico
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: goopdateres_cs.dll.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://de.search.yahoo.com/
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://es.ask.com/1A
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://es.search.yahoo.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://esearch.rakuten.co.jp/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://espanol.search.yahoo.com/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://espn.go.com/favicon.ico
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FBF7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://find.joins.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fr.search.yahoo.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.pchome.com.tw/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.altervista.org/bH
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.altervista.org/favicon.icoQ
Source: iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie8.ebay.com/open
Source: iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.icoQ
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico_
Source: iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.icoi
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.monster.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.atlas.cz/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45AB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://in.search.yahoo.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://in.search.yahoo.com/E
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.dada.net/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.dada.net/favicon.icoQ
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.yahoo.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jobsearch.monster.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://kr.search.yahoo.com/C
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/Z
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: BraveUpdate.exe, 0000000A.00000002.2087056339.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1785694059.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1785090209.00000000012CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://microsoft.co_&
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://msk.afisha.ru/
Source: iexplore.exe, 00000010.00000002.3581243281.0000013F45736000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ns.a
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocnsearch.goo.ne.jp/H
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://ocsp.digicert.com0
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://ocsp.digicert.com0A
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://ocsp.digicert.com0C
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://ocsp.digicert.com0X
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://openimage.interpark.com/interpark.icoQ
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/Z
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/favicon.icot
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.linternaute.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.tf1.fr/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.tf1.fr/favicon.ico=
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://rover.ebay.com
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ru.search.yahoo.com
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sads.myspace.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search-dyn.tiscali.it/4
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.about.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.alice.it/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.alice.it/favicon.icoB
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.co.uk/dH
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.com/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.in/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.atlas.cz/I
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.auction.co.kr/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.auone.jp/5
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.books.com.tw/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.books.com.tw/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.books.com.tw/favicon.icoT
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.centrum.cz/(HR;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.centrum.cz/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.chol.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.chol.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.cn.yahoo.com/Y
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/favicon.icoY
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/.
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.co.uk/TH
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.ico-II;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.icoX
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.de/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.es/vHx;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.fr/JHl;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.in/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.it/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/P
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.espn.go.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/favicon.icot
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gismeteo.ru/~
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.goo.ne.jp/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.hanafos.com/
Source: iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.hanafos.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.interpark.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/favicon.icoL
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AA0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS5_
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=IE7BOX&src=%7Breferrer:source?%7DiBR
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=IE7RE&src=%7Breferrer:source?%7D
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=MSNIE7&src=%7Breferrer:source?%7D
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&Form=IE8SRC&src=%7Breferrer:source%7D
Source: iexplore.exe, 00000010.00000002.3579229843.0000013F42DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&mkt=%7BLanguage%7D&FORM=IE8SRC&src=%7Breferr
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=%7Breferrer:source?%7D
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=%7Breferrer:source?%7D&Form=IE8SRC
Source: iexplore.exe, 00000010.00000002.3579229843.0000013F42E36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=IE-SearchBox&Form=IE8SRCiBR
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.livedoor.com/
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.livedoor.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.livedoor.com/favicon.icoRF
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.co.uk/A;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.com/favicon.ico
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=CBPWg
Source: iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: iexplore.exe, 00000010.00000003.1920392083.0000013F45AC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.nate.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.naver.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.naver.com/r
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.nifty.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.orange.co.uk/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.rediff.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.rediff.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.seznam.cz/);
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.seznam.cz/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.sify.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jp
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jpl
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.com/
Source: iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yam.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search1.taobao.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search2.estadao.com.br/lGP;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://searchresults.news.com.au/
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://searh.goo.ne.jp/fav
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://service2.bfast.com/_;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://so-net.search.goo.ne.jp/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.aol.de/RHT;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.freenet.de/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.freenet.de/favicon.icoKD
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.lycos.de/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.t-online.de/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/_
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tw.search.yahoo.com/O
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.ask.com/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.ask.com/favicon.icoIIe;
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.search.yahoo.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vachercher.lycos.fr/;;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://video.globo.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://video.globo.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.ask.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/favicon.icoH
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/g
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.icoQ
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/favicon.icorAN;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.co.jp/&HH;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.co.uk/
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/favicon.iconI
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&camp=1789&creativ
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.de/LHv;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aol.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.arrakis.com/favicon.icoeI
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.arrakis.com/nH
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/favicon.icoG
Source: iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/favicon.icoH
Source: iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/favicon.icoQ
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ask.com/A
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.auction.co.kr/auction.icoZF
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cdiscount.com/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/favicon.icoG
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico##p
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/favicon.icog
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.clarin.com/favicon.icorIl;
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cnet.co.uk/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cnet.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dailymail.co.uk/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: BraveBrowserSetup-BRV002.exe, BraveCrashHandler.exe.0.dr, BraveUpdateBroker.exe.1.dr, goopdateres_ta.dll.1.dr, goopdateres_ms.dll.1.dr, goopdateres_gu.dll.1.dr, goopdateres_hr.dll.1.dr, goopdateres_hi.dll.0.dr, goopdateres_mr.dll.1.dr, goopdateres_pl.dll.1.dr, goopdateres_gu.dll.0.dr, BraveUpdate.exe.1.dr, goopdateres_ko.dll.1.dr, BraveUpdateCore.exe.1.dr, goopdateres_ar.dll.0.dr, goopdateres_pt-PT.dll.1.dr, goopdateres_da.dll.0.dr, goopdateres_lv.dll.1.dr, goopdateres_hr.dll.0.dr, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.drString found in binary or memory: http://www.digicert.com/CPS0
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.etmall.com.tw/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.excite.co.jp/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.expedia.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.expedia.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gismeteo.ru/favicon.ico0
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gmarket.co.kr/
Source: iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.in/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.jp/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.uk/xH
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.br/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.sa/1;
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.tw/
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/2
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.cz/
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.de/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.es/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.fr/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.it/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.pl/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.ru/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.si/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iask.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iask.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iask.com/j
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kkbox.com.tw/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.linternaute.com/favicon.ico
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.live.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.maktoob.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/4D
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolivre.com.br/=D
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.merlin.com.pl/
Source: iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mtv.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mtv.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.myspace.com/favicon.ico&D
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.najdi.si/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.najdi.si/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nate.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.neckermann.de/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.neckermann.de/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.news.com.au/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nifty.com/favicon.ico
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nytimes.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.orange.fr/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.otto.de/favicon.icoK
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozon.ru/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozon.ru/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozu.es/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.paginasamarillas.es/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pchome.com.tw/favicon.icobA
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.priceminister.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.priceminister.com/favicon.icozAV;
Source: iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.recherche.aol.fr/
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.reddit.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rtl.de/;
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rtl.de/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.servicios.clarin.com/_I
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.shopzilla.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sify.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.soso.com/
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.soso.com/$
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.soso.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.t-online.de/favicon.icog
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taobao.com/
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taobao.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.target.com/S;
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.target.com/favicon.icoL
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/favicon.icou
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.timesonline.co.uk/img/favicon.icoQ
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tiscali.it/favicon.ico~
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.walmart.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.walmart.com/favicon.ico/
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.wikipedia.com/
Source: iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ya.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yam.com/favicon.ico
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3586576235.0000013F48DB0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3586576235.0000013F48DB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/
Source: iexplore.exe, 00000010.00000002.3590062687.0000013F49B60000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/p
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www3.fnac.com/
Source: iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www3.fnac.com/favicon.ico
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45AB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea
Source: iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://z.about.com/m/a08.ico
Source: me[1].json.46.drString found in binary or memory: https://abcnews.go.com/US/nex-benedict-died-suicide-medical-examiners-report-states/story?id=1080934
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSx
Source: me[1].json.32.drString found in binary or memory: https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=037f6c7e-4d24-453c-84b3-0a57b795bf15&
Source: me[1].json.46.drString found in binary or memory: https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=d7d5f1d5-6585-455e-8a09-5878e6609026&
Source: me[1].json.32.dr, me[1].json.46.drString found in binary or memory: https://apnews.com/article/artificial-intelligence-elections-disinformation-chatgpt-bc283e7426402f0b
Source: me[1].json.46.drString found in binary or memory: https://apnews.com/article/elon-musk-don-lemon-cancellation-bdbed1da86c3640daa63e384c734f5db
Source: me[1].json.32.drString found in binary or memory: https://apnews.com/article/north-korea-kim-tank-training-us-south-244d613ea6dfaa0a38cffcb3dddc8f06
Source: me[1].json.46.drString found in binary or memory: https://apnews.com/article/south-dakota-texas-kristi-noem-dental-teeth-775ac3e08a73e232023e38425bc5a
Source: W4C87BS5.htm.17.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.3864859aea200a56092d.js
Source: W4C87BS5.htm.17.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.1287eb605f92d676502d.js
Source: W4C87BS5.htm.17.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.afc9b4502f5cf6f88cca.js
Source: W4C87BS5.htm.17.drString found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.79af82f3c5b028c7ea81.js
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGB8-dark
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-dark
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: me[1].json.32.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gALZ
Source: me[1].json.32.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gALZ-dark
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHFG
Source: me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHFG-dark
Source: me[1].json.32.dr, me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13govM
Source: me[1].json.32.dr, me[1].json.46.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13govM-dark
Source: me[1].json.32.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3
Source: me[1].json.32.drString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark
Source: manifest.json.22.drString found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.22.drString found in binary or memory: https://chromewebstore.google.com/
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45D52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: 000003.log5.22.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FBB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FC0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FBB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB93000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1798007535.000001652FBE4000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1798007535.000001652FBD8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1798007535.000001652FBF7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FBB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12I8qo.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1aEYRp.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1aEYRs.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1iSNVn.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1iSYWT.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1iT4bt.img
Source: me[1].json.32.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAVmfsD.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXL7Uv.img
Source: me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAywOab.img
Source: me[1].json.32.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img
Source: me[1].json.32.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1huGZT.img
Source: me[1].json.32.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1huLs7.img
Source: me[1].json.32.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1huQ5U.img
Source: me[1].json.32.dr, me[1].json.46.drString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBACBCB.img
Source: iexplore.exe, 00000010.00000002.3579229843.0000013F42E36000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3579229843.0000013F42E67000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45BA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033%
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: me[1].json.32.drString found in binary or memory: https://metro.co.uk/2023/12/26/im-abrosexual-took-30-years-realise-20003313/?ITO=msn
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FBB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000000D.00000003.1798007535.000001652FB62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.brave.com/hlproductfrom_extra_codesptestsource%1%2ATL:%p%s
Source: BraveUpdate.exe, 0000000C.00000003.2371561745.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2384939079.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2339517640.0000000002218000.00000004.00000800.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2378405062.0000000000BE2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2385579117.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2378923760.0000000000BE5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/122.1.63.174/x64/
Source: svchost.exe, 0000000D.00000002.3581308358.000001652A62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3586638007.0000016530080000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3584682895.000001652FC30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3581237775.000001652A613000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1981352245.000001652FD34000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1991097026.000001652FAF5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3584543181.000001652FC00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates-cdn.bravesoftware.com/build/Brave-Release/release/win/122.1.63.174/x64/brave_install
Source: BraveUpdate.exe, 0000000A.00000002.2087056339.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1785090209.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2376105670.0000000000B40000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2384037417.0000000000B43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/cr/reportBraveSoftware
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%
Source: BraveUpdate.exe, 0000000C.00000002.2384037417.0000000000B43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2
Source: BraveUpdate.exe, 0000000C.00000003.2376710818.0000000000B85000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2384939079.0000000000B85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2?cup2key=2:FHaiRXwdkaTzfc5WY8ONYeB8lUhczsui5xX11t6M
Source: BraveUpdate.exe, 0000000A.00000002.2086951587.0000000001268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2M2
Source: BraveUpdate.exe, 0000000A.00000002.2087056339.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1785090209.00000000012B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/service/update2i
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com/support/installer/?https://updates.bravesoftware.com/service/updat
Source: BraveUpdate.exe, 0000000A.00000002.2086951587.0000000001268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.bravesoftware.com:443/service/update2
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/xy.dll
Source: me[1].json.32.drString found in binary or memory: https://www.buzzfeed.com/carolinebologna/rudest-things-someone-elses-house?origin=microsoft
Source: content_new.js.22.drString found in binary or memory: https://www.google.com/chrome
Source: me[1].json.46.drString found in binary or memory: https://www.hollywoodreporter.com/tv/tv-news/network-tv-cancellations-renewals-2024-1235817747/
Source: me[1].json.32.drString found in binary or memory: https://www.hollywoodreporter.com/tv/tv-news/robyn-bernard-dead-general-hospital-actress-1235852051/
Source: me[1].json.32.drString found in binary or memory: https://www.kindafrugal.com/10-states-americans-are-leaving-in-droves/
Source: me[1].json.32.drString found in binary or memory: https://www.kindafrugal.com/23-ways-to-reduce-housing-costs/
Source: me[1].json.46.drString found in binary or memory: https://www.mmafighting.com/2024/3/13/24100127/francis-ngannou-felt-he-was-falling-asleep-warming-up
Source: me[1].json.32.drString found in binary or memory: https://www.mmamania.com/2024/3/13/24099921/mark-coleman-update-intubated-ufc-vet-somewhat-conscious
Source: me[1].json.32.drString found in binary or memory: https://www.mmamania.com/2024/3/13/24100135/gel-gate-chito-vera-says-sean-omalley-was-greased-to-the
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/8
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49498000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=
Source: {82FFDACA-E1DC-11EE-8C2C-ECF4BBEA1588}.dat.16.dr, ~DFE032F33512B6866F.TMP.16.dr, ~DF576EA7BC8D9C81C4.TMP.16.dr, ~DFF8A2C987D8847B2E.TMP.16.drString found in binary or memory: https://www.msn.com/?ocid=iehp
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45CE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp%
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3579229843.0000013F42E7C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141X
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141h
Source: iexplore.exe, 00000010.00000002.3579229843.0000013F42E36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp1
Source: iexplore.exe, 00000010.00000002.3577973029.000000257C0F0000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp3S-1-5-21-224612247675100205117-2
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F493EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp4
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp5nj9
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp7zV=
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp:
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F493C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp;46
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp;hh?
Source: iexplore.exe, 00000010.00000002.3581243281.0000013F45736000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp=
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpJvc=
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45CC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpM(
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45BC9000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpMicrosoft
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45CC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpQ(
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpREG;
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpT
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45CE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpTerms
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpWx
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F493EA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpX
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp_
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpc
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F492B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpco
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpd
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpg
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehpTerms
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehphTerms
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehpkID=403856&language=
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehpn.com/?ocid=iehprchBox&FORM=IE11SR
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpijC?
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45CE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpink/p/?LinkId=255141C255141N
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpivaI
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpl
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpll
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehposoft
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4948A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49333000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=2551414
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45CE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141IE8SRC
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141List
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141orer
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehppD
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F492B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehppl
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F493EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpppDat
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehprjX?
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehprosofthp
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4948A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpst
Source: iexplore.exe, 00000010.00000002.3580901811.0000013F44850000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpstorageTeststorageTest4C4C6177
Source: iexplore.exe, 00000010.00000002.3580901811.0000013F44850000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpstorageTeststorageTestw.msn.com/?ocid=iehp
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpultOo$:
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45D75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpx
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpy
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpz
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/cal
Source: me[1].json.46.drString found in binary or memory: https://www.msn.com/en-us/community/channel/vid-cj9pqbr0vn9in2b6ddcd8sfgpfq6x6utp44fssrv6mc2gtybw0us
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F492B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/f0
Source: iexplore.exe, 00000010.00000002.3585069476.0000013F45E44000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F493C3000.00000004.00000020.00020000.00000000.sdmp, imagestore.dat.16.drString found in binary or memory: https://www.msn.com/favicon.ico
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico6jk=Q
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoA
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoO
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F493EA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F492B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icod=iehp
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icod=iehpfault
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49252000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoi
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F49267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icoio
Source: iexplore.exe, 00000010.00000002.3578137247.000000257C6F6000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icok
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45C94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.icorosoft
Source: iexplore.exe, 00000010.00000002.3587038633.0000013F4923E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45CBE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3585069476.0000013F45E32000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F4946E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45BA5000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F493BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/spartan/ientp?locale=en-CH&market=CH&enableregulatorypsm=0&enablecpsm=0&NTLogo=0
Source: me[1].json.46.drString found in binary or memory: https://www.profootballnetwork.com/kansas-city-chiefs-news-march-13-2024/
Source: me[1].json.32.drString found in binary or memory: https://www.self.com/story/heart-attack-at-34-symptoms
Source: me[1].json.32.drString found in binary or memory: https://www.si.com/nfl/steelers/news/former-pittsburgh-steelers-mason-rudolph-signs-titans
Source: me[1].json.46.drString found in binary or memory: https://www.telegraph.co.uk/films/0/robert-downey-jr-oscars-oppenheimer-best-supporting-actor/
Source: me[1].json.32.drString found in binary or memory: https://www.thestreet.com/travel/las-vegas-strip-casino-brings-back-superstar-group-after-sellouts
Source: me[1].json.46.drString found in binary or memory: https://www.usatoday.com/story/news/politics/2024/03/13/hur-transcript-joe-biden-beau-biden-death/72
Source: me[1].json.32.drString found in binary or memory: https://www.usatoday.com/story/news/politics/2024/03/13/kamala-harris-to-visit-planned-parenthood-cl
Source: me[1].json.32.drString found in binary or memory: https://www.washingtonpost.com/science/2024/02/20/radcliffe-wave-galaxy-structure/
Source: me[1].json.46.drString found in binary or memory: https://www.yardbarker.com/entertainment/articles/20_films_with_the_most_memorable_twist_endings_101
Source: me[1].json.46.drString found in binary or memory: https://www.yardbarker.com/entertainment/articles/the_best_and_worst_films_of_2023_so_far_110823/s1_
Source: me[1].json.46.drString found in binary or memory: https://www.yardbarker.com/nfl/articles/bears_sign_journeyman_veteran_qb_to_a_one_year_deal/s1_14819
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A33498C lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,4_2_00007FF65A33498C
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A33498C lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,4_2_00007FF65A33498C

System Summary

barindex
Downloads suspicious files via Chrome
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7648_689802529\CRX_INSTALL\content.jsJump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7648_689802529\CRX_INSTALL\content_new.jsJump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\eventpage_bin_prod.jsJump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\page_embed_script.jsJump to dropped file
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_009941980_2_00994198
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00985AB60_2_00985AB6
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00997A0B0_2_00997A0B
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_0098C5D40_2_0098C5D4
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00993D100_2_00993D10
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_0099168D0_2_0099168D
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AB3C0B1_2_00AB3C0B
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009B3C0B2_2_009B3C0B
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A33D1644_2_00007FF65A33D164
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A33D81C4_2_00007FF65A33D81C
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A3415484_2_00007FF65A341548
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A341D684_2_00007FF65A341D68
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_0007C7FB14_2_0007C7FB
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeCode function: 49_2_00007FF6ECF5133049_2_00007FF6ECF51330
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: String function: 00071AB0 appears 33 times
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: String function: 00AA7FA0 appears 33 times
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: String function: 00982BA0 appears 236 times
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: String function: 00986F60 appears 33 times
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: String function: 009A7FA0 appears 33 times
Source: goopdateres_ca.dll.0.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.114
Source: goopdateres_fil.dll.0.drStatic PE information: Resource name: RT_STRING type: VAX COFF executable, sections 80, created Wed Mar 25 10:31:05 1970, not stripped, version 108
Source: goopdateres_hu.dll.0.drStatic PE information: Resource name: RT_STRING type: MIPSEL MIPS-II ECOFF executable not stripped - version 0.101
Source: goopdateres_ms.dll.0.drStatic PE information: Resource name: RT_STRING type: 370 sysV executable not stripped
Source: goopdateres_th.dll.0.drStatic PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: goopdateres_tr.dll.0.drStatic PE information: Resource name: RT_STRING type: 370 XA sysV pure executable not stripped
Source: goopdateres_vi.dll.0.drStatic PE information: Resource name: RT_STRING type: iAPX 286 executable small model (COFF) not stripped
Source: goopdateres_hu.dll.1.drStatic PE information: Resource name: RT_STRING type: MIPSEL MIPS-II ECOFF executable not stripped - version 0.101
Source: goopdateres_ms.dll.1.drStatic PE information: Resource name: RT_STRING type: 370 sysV executable not stripped
Source: goopdateres_th.dll.1.drStatic PE information: Resource name: RT_STRING type: PDP-11 overlaid pure executable not stripped
Source: goopdateres_tr.dll.1.drStatic PE information: Resource name: RT_STRING type: 370 XA sysV pure executable not stripped
Source: goopdateres_vi.dll.1.drStatic PE information: Resource name: RT_STRING type: iAPX 286 executable small model (COFF) not stripped
Source: goopdateres_ca.dll.1.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.114
Source: goopdateres_fil.dll.1.drStatic PE information: Resource name: RT_STRING type: VAX COFF executable, sections 80, created Wed Mar 25 10:31:05 1970, not stripped, version 108
Source: brave_installer-x64.exe.12.drStatic PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: brave_installer-x64.exe.12.drStatic PE information: Resource name: BL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 1398528 bytes, 1 file, at 0x2c "setup.exe", number 1, 106 datablocks, 0x1 compression
Source: brave_installer-x64.exe0.12.drStatic PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: brave_installer-x64.exe0.12.drStatic PE information: Resource name: BL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 1398528 bytes, 1 file, at 0x2c "setup.exe", number 1, 106 datablocks, 0x1 compression
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CB0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E7C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ru.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D71000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ja.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000347D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_de.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D21000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ml.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E57000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E1D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002ECE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_tr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003572000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_iw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bg.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035DD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ms.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CCF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fa.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CA3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_el.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002EEA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-TW.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdate.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdate.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D7C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_it.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es-419.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003505000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002F04000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-CN.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036C4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_uk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000369C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_te.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003565000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_it.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D3C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_id.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E49000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003557000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_is.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E2E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ru.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-BR.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CC1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_et.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-PT.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003613000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-BR.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C1E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ar.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003680000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_th.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E21000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ro.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdate.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdate.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1722549132.0000000000BCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdateSetup.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DC1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_mr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000034A7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en-GB.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C6C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ca.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C95000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_de.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002EA9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_tr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es-419.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DB1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ko.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D1D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CF4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fa.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003462000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_cs.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000368E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ta.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E97000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003447000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CA6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000002.2372111066.00000000008C4000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-TW.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D53000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ur.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D01000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_es.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_no.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DF5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ms.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C50000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bg.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C36000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_am.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ko.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C87000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_da.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036EC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-CN.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBraveUpdate.exeJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdate.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E3C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_no.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ml.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C7D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_el.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D46000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C43000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ar.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_pt-PT.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_da.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C5E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_bn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000358C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_kn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EA5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ta.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000034F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fil.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D98000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lt.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DBE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lt.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EE9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ur.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DDD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_nl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_iw.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EB3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_te.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CDC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000353C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_hu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C7A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_cs.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003455000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ca.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DE7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_mr.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003513000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_gu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D0F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_fil.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DA6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_lv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EF6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_vi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C11000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_am.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D97000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ja.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DA3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_kn.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003672000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_sv.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CE7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_et.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D2A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_gu.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E46000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_ro.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EC1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_th.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C8B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CBE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_en-GB.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D6E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_is.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_id.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002F10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_zh-TW.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002ED1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_vi.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EDC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_uk.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegoopdateres_nl.dllJ vs BraveBrowserSetup-BRV002.exe
Source: BraveBrowserSetup-BRV002.exeBinary or memory string: OriginalFilenameBraveUpdateSetup.exeJ vs BraveBrowserSetup-BRV002.exe
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: propsys.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: edputil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: slc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: sppc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: webio.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncrypt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msxml3.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: atlthunk.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: textinputframework.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: textshaping.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: version.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msimg32.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: wkscli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mdmregistration.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: omadmapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: powrprof.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iri.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: umpdc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dsreg.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: cscapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: msxml3.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: webio.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winnsi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rasadhlp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ntasn1.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncrypt.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: winsta.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: bitsproxy.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: dpapi.dll
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
Source: BraveBrowserSetup-BRV002.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: mal51.evad.winEXE@107/555@0/28
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_0098324D GetLastError,GetLastError,SetLastError,SetLastError,FormatMessageW,GetLastError,SetLastError,LocalFree,0_2_0098324D
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00982024 GetTempFileNameW,FindResourceW,LoadResource,LockResource,CreateFileW,SizeofResource,SetFilePointerEx,CloseHandle,0_2_00982024
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftwareJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeFile created: C:\Users\user\AppData\Local\BraveSoftware
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BraveSoftware{BC6A0F04-AE75-459F-B879-2C961515B78A}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BraveSoftwareS-1-5-21-2246122658-3693405117-2476756634-1002{BC6A0F04-AE75-459F-B879-2C961515B78A}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{C50974A0-5616-4DC6-AC6D-D4EFF6F5FAC3}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{FE0E7F6B-B8BD-4EEE-A8F1-8CE625AEF520}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{BC6A0F04-AE75-459F-B879-2C961515B78A}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{4E15433F-5E08-47A1-AA4F-B1D1657EE725}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{BD1D9A71-3C5B-436B-BAD8-D337E3226819}
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeMutant created: \Sessions\1\BaseNamedObjects\Global\BraveSoftware{C50974A0-5616-4DC6-AC6D-D4EFF6F5FAC3}
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeMutant created: \BaseNamedObjects\Global\BraveSoftware{0EADE80E-E9B8-4A5D-AF64-6D2A918F597C}
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmpJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCommand line argument: kernel32.dll0_2_0098277B
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCommand line argument: kernel32.dll1_2_00AA6C1E
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCommand line argument: DllEntry1_2_00AA6C1E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCommand line argument: kernel32.dll2_2_009A6C1E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCommand line argument: DllEntry2_2_009A6C1E
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCommand line argument: BraveUpdate.exe14_2_00071152
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: BraveBrowserSetup-BRV002.exeString found in binary or memory: %1!s!-Installer
Source: BraveBrowserSetup-BRV002.exeString found in binary or memory: r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h
Source: BraveBrowserSetup-BRV002.exeString found in binary or memory: Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile read: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeEvasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: unknownProcess created: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeProcess created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGOUMwOTg2Qy00NjYzLTQzNDUtQjFBNy1FQkE2Njc3OTA1RkV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RTc5NTUyNEYtOEU0Qi00RUYwLTgyOUUtOEZEQkZFODFDNTI4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI0ODI4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{F9C0986C-4663-4345-B1A7-EBA6677905FE}
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9474 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6184 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75012 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: unknownProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9480 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:1578252 /prefetch:2
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75020 /prefetch:2
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1788,i,66099047840648098,18039867653235187412,262144 /prefetch:3
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\guiCA69.tmp
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeProcess created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=noneJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvcJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserverJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGOUMwOTg2Qy00NjYzLTQzNDUtQjFBNy1FQkE2Njc3OTA1RkV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RTc5NTUyNEYtOEU0Qi00RUYwLTgyOUUtOEZEQkZFODFDNTI4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI0ODI4Ii8-PC9hcHA-PC9yZXF1ZXN0PgJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{F9C0986C-4663-4345-B1A7-EBA6677905FE}Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe" Jump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstallJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\guiCA69.tmp
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9474 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75012 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9480 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:1578252 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75020 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\guiCA69.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6184 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1788,i,66099047840648098,18039867653235187412,262144 /prefetch:3
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\Office\16.0\Lync
Source: BraveBrowserSetup-BRV002.exeStatic PE information: certificate valid
Source: BraveBrowserSetup-BRV002.exeStatic file information: File size 1446992 > 1048576
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x136800
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: BraveBrowserSetup-BRV002.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: BraveBrowserSetup-BRV002.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: goopdateres_unsigned_ms.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DC1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748660465.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748783702.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ms.dll.1.dr
Source: Binary string: goopdateres_unsigned_fa.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CE7000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737623769.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737479191.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ru.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E21000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E46000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752240843.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752136387.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_lt.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DB1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D8C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1745743530.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1746592148.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_el.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000347D000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C95000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735540617.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735449369.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1756132811.000000000087F000.00000004.00000020.00020000.00000000.sdmp, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_tr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036A9000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EC1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754014524.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_de.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C87000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C62000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735078370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734919338.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_de.dll.0.dr
Source: Binary string: psuser_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2372111066.00000000008C4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755436587.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_mr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035C1000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DD9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748350850.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748222939.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_mr.dll.1.dr
Source: Binary string: goopdateres_unsigned_bg.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C1E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C43000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733003348.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733178204.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdbS source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731696317.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731379800.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731610280.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1763510360.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1766907880.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1765603391.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000002.1769778901.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000000.1767999510.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: goopdateres_unsigned_gu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003505000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D1D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739012890.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738930243.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_gu.dll.1.dr, goopdateres_gu.dll.0.dr
Source: Binary string: goopdateres_unsigned_th.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000369C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EB3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753847668.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E6E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752900983.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateComRegisterShell64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731696317.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731379800.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731610280.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000000.1763510360.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000002.1766907880.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000005.00000000.1765603391.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000002.1769778901.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp, BraveUpdateComRegisterShell64.exe, 00000007.00000000.1767999510.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: psmachine_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755667817.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755195874.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_arm64.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2372111066.00000000008C4000.00000004.00000010.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755436587.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_am.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732345477.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732249902.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\jenkins\x64-release\src\out\Release\mini_installer.exe.pdb source: brave_installer-x64.exe, 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmp, brave_installer-x64.exe, 00000031.00000000.2145638961.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmp, brave_installer-x64.exe.12.dr
Source: Binary string: goopdateres_unsigned_ta.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003680000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E97000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753507776.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ta.dll.1.dr
Source: Binary string: goopdateres_unsigned_cs.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C6C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003455000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734426603.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734335370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_cs.dll.1.dr
Source: Binary string: goopdateres_unsigned_lv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747332863.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747463488.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_lv.dll.1.dr
Source: Binary string: goopdate_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003513000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D2A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739422212.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739255907.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_hi.dll.0.dr, goopdateres_hi.dll.1.dr
Source: Binary string: goopdateres_unsigned_es-419.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CA6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CCB000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737018312.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736881596.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mi_exe_stub.pdb source: BraveBrowserSetup-BRV002.exe, BraveUpdateSetup.exe.0.dr
Source: Binary string: goopdateres_unsigned_pt-BR.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E1D000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750506641.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750691999.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_pt-BR.dll.0.dr, goopdateres_pt-BR.dll.1.dr
Source: Binary string: goopdateres_unsigned_hr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D38000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D13000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739682278.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1739528217.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_hr.dll.1.dr, goopdateres_hr.dll.0.dr
Source: Binary string: BraveUpdate_unsigned.pdb source: BraveUpdate.exe, BraveUpdate.exe, 00000002.00000000.1758872367.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000003.00000002.1771595446.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000006.00000002.1771903388.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000008.00000002.1773380799.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000009.00000002.1775532981.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000A.00000000.1774364093.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000B.00000000.1785977546.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000C.00000002.2382910661.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000000F.00000000.1842720054.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000001D.00000002.1937800299.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 00000025.00000002.1975410538.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe, 0000002C.00000000.2045807918.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, BraveUpdate.exe.1.dr
Source: Binary string: goopdateres_unsigned_id.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D53000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000353C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740463507.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740291601.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_id.dll.0.dr
Source: Binary string: psuser_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755195874.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_zh-TW.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036EC000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000002.2372111066.00000000008BE000.00000004.00000010.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754884888.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveCrashHandlerArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731279920.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731183450.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveCrashHandler64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730441814.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateCore_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729576252.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729944101.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729844295.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateCore.exe.1.dr
Source: Binary string: BraveCrashHandler_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730360186.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730031120.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730252432.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveCrashHandler.exe.0.dr
Source: Binary string: goopdateres_unsigned_sw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E8A000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003672000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753339647.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveCrashHandler64_unsigned.pdb~ source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1730441814.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_it.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003557000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D6E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1741745508.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1741378088.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pt-PT.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003613000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750968422.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1751191588.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_pt-PT.dll.1.dr
Source: Binary string: goopdateres_unsigned_vi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036D2000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EE9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754536030.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_bn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C50000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733430885.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733591723.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_bn.dll.0.dr
Source: Binary string: goopdateres_unsigned_sv.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E7C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E57000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753062470.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_sv.dll.1.dr
Source: Binary string: goopdateres_unsigned_ja.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003572000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D8A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1743498933.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1742842959.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ja.dll.0.dr
Source: Binary string: BraveUpdateBroker_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757893344.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757619314.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757809186.000000000088F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateBroker.exe.1.dr
Source: Binary string: goopdateres_unsigned_es.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000034A7000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CBE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736781422.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736699628.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_es.dll.0.dr
Source: Binary string: BraveUpdateCore_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729576252.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729944101.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729844295.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateCore.exe.1.dr
Source: Binary string: psmachine_unsigned_64.pdbG source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755885475.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_is.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D3C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D61000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740899243.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1741017579.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_is.dll.0.dr
Source: Binary string: goopdateres_unsigned_uk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002ECE000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002EA9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754180457.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ro.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E13000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E38000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1751752611.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1751637703.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fr.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D0F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738591327.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738443283.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ca.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003447000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1733967260.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734062343.000000000087D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_nl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035DD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DF5000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1748929382.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1749115057.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_arm64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1756132811.000000000087F000.00000004.00000020.00020000.00000000.sdmp, psmachine_arm64.dll.1.dr, psmachine_arm64.dll.0.dr
Source: Binary string: goopdateres_unsigned_ko.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000358C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DA3000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1745242892.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1745507066.000000000087D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ko.dll.1.dr
Source: Binary string: goopdateres_unsigned_et.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737317710.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737387212.000000000087D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdbW source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732005132.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731926937.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_iw.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D7C000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003565000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1742078642.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1742324115.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_iw.dll.0.dr
Source: Binary string: goopdateres_unsigned_ur.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000036C4000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EDC000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754357844.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ur.dll.0.dr
Source: Binary string: goopdateres_unsigned_te.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.000000000368E000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EA5000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1753673947.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_te.dll.1.dr
Source: Binary string: goopdateres_unsigned_no.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DDD000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1749390758.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1749568850.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_no.dll.0.dr
Source: Binary string: goopdateres_unsigned_fil.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CDC000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738260944.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738343246.000000000087D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdate_unsigned.pdbz source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_pl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.00000000035F8000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750222290.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1750026328.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_pl.dll.1.dr
Source: Binary string: goopdateres_unsigned_en-GB.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CB0000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C8B000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736052372.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1736334569.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_sk.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E2E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752515656.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752355678.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_fi.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002CCF000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CF4000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1738015984.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1737933319.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ml.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002DCB000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002DA6000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747600952.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1747781562.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_hu.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D21000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D46000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740087322.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1740008716.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: BraveUpdateOnDemand_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1757980764.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1758250397.000000000087F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1758170115.000000000088F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdateOnDemand.exe, 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000000E.00000000.1842024178.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000001B.00000002.1914575441.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000001B.00000000.1907421355.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 00000024.00000000.1964220932.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 00000024.00000002.1968846412.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000002B.00000000.2043672766.000000000007E000.00000002.00000001.01000000.00000012.sdmp, BraveUpdateOnDemand.exe, 0000002B.00000002.2048025475.000000000007E000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: psmachine_unsigned.pdbK source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755667817.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_en.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002CA3000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C7D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735658873.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1735826271.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000002.2341158597.00000000007E0000.00000002.00000001.00040000.0000001C.sdmp, BraveUpdate.exe, 00000002.00000002.1760857677.0000000000F80000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 00000008.00000002.1774084733.00000000012D0000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000000B.00000002.2329878557.00000000019C0000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000000C.00000002.2385973749.0000000000D40000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000000F.00000002.1845247303.0000000000B60000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000001D.00000002.1935084794.0000000000950000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 00000025.00000002.1975990062.0000000001650000.00000002.00000001.00040000.00000009.sdmp, BraveUpdate.exe, 0000002C.00000002.2055568647.0000000000B40000.00000002.00000001.00040000.00000009.sdmp, goopdateres_en.dll.0.dr
Source: Binary string: goopdateres_unsigned_da.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000003462000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C7A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734545982.000000000087E000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1734708345.000000000088D000.00000004.00000020.00020000.00000000.sdmp, goopdateres_da.dll.0.dr
Source: Binary string: BraveUpdateComRegisterShellArm64_unsigned.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732005132.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1731926937.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1755885475.000000000087F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_ar.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002C36000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002C11000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732753472.000000000088D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1732468828.000000000087E000.00000004.00000020.00020000.00000000.sdmp, goopdateres_ar.dll.0.dr
Source: Binary string: goopdateres_unsigned_sl.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002E61000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002E3C000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1752733686.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_zh-CN.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002EF6000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002ED1000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1754711049.000000000087E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: goopdateres_unsigned_kn.pdb source: BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.0000000002D71000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.0000000002D97000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1744734413.000000000087D000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1744417417.000000000088D000.00000004.00000020.00020000.00000000.sdmp
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: BraveBrowserSetup-BRV002.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A333A10 LoadLibraryW,GetProcAddress,FreeLibrary,4_2_00007FF65A333A10
Source: BraveUpdateSetup.exe.1.drStatic PE information: real checksum: 0x165c94 should be: 0x1621a3
Source: BraveUpdateSetup.exe.0.drStatic PE information: real checksum: 0x165c94 should be: 0x1621a3
Source: BraveBrowserSetup-BRV002.exeStatic PE information: real checksum: 0x165c94 should be: 0x1621a3
Source: BraveUpdateComRegisterShell64.exe.0.drStatic PE information: section name: _RDATA
Source: psmachine.dll.0.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.0.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.0.drStatic PE information: section name: _RDATA
Source: psuser.dll.0.drStatic PE information: section name: .orpc
Source: psuser_64.dll.0.drStatic PE information: section name: .orpc
Source: psuser_64.dll.0.drStatic PE information: section name: _RDATA
Source: BraveCrashHandler64.exe.0.drStatic PE information: section name: _RDATA
Source: psmachine_arm64.dll.0.drStatic PE information: section name: .orpc
Source: psuser_arm64.dll.0.drStatic PE information: section name: .orpc
Source: psuser.dll.1.drStatic PE information: section name: .orpc
Source: psuser_64.dll.1.drStatic PE information: section name: .orpc
Source: psuser_64.dll.1.drStatic PE information: section name: _RDATA
Source: psuser_arm64.dll.1.drStatic PE information: section name: .orpc
Source: psmachine.dll.1.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.1.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.1.drStatic PE information: section name: _RDATA
Source: psmachine_arm64.dll.1.drStatic PE information: section name: .orpc
Source: BraveCrashHandler64.exe.1.drStatic PE information: section name: _RDATA
Source: BraveUpdateComRegisterShell64.exe.1.drStatic PE information: section name: _RDATA
Source: brave_installer-x64.exe.12.drStatic PE information: section name: .retplne
Source: brave_installer-x64.exe0.12.drStatic PE information: section name: .retplne
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00998226 push ecx; ret 0_2_00998239
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AB4346 push ecx; ret 1_2_00AB4359
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009B4346 push ecx; ret 2_2_009B4359
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_0007CF36 push ecx; ret 14_2_0007CF49
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 15_2_02F0EB54 pushad ; ret 15_2_02F0EB55
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 29_2_02B7E233 push eax; retf 29_2_02B7E299
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 29_2_02B7F12D pushad ; ret 29_2_02B7F131
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 29_2_02B7CEAA push eax; iretd 29_2_02B7CEAD
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 29_2_02B7E567 push eax; retf 29_2_02B7E599
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 37_2_039CED30 pushad ; ret 37_2_039CED31
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 37_2_039CCAAC push eax; retf 37_2_039CCAAD
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 37_2_039CEE64 pushad ; ret 37_2_039CEE65
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 44_2_0306EBA8 pushad ; ret 44_2_0306EBA9
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 44_2_0306CBC0 push eax; iretd 44_2_0306CBC1
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 44_2_0306ECDC pushad ; ret 44_2_0306ECDD
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateOnDemand.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateBroker.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine_64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_tr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateCore.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdate.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_nl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\CR_DA195.tmp\setup.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ro.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es.dllJump to dropped file
Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\Temp\{21DA6F9B-FFAF-40CA-B20A-685EF0F3A5DF}-brave_installer-x64.exe (copy)Jump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_vi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_id.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_iw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ja.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_uk.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\122.1.63.174\brave_installer-x64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ms.dllJump to dropped file
Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\Temp\BIT5671.tmpJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ml.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_is.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShell64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es-419.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdate.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_am.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ru.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateBroker.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_es.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateSetup.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bg.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_te.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_el.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ca.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fa.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateSetup.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateCore.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeFile created: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeFile created: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A3344A8 RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,4_2_00007FF65A3344A8

Boot Survival

barindex
Creates an undocumented autostart registry key
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Found evasive API chain (may stop execution after checking volume information)
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeEvasive API call chain: GetVolumeInformation,DecisionNodes,ExitProcess
Found evasive API chain checking for user administrative privileges
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_0-13187
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_cs.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ko.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ur.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ta.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_am.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateBroker.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_it.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine_64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_tr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdate.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateCore.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ja.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_nl.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\CR_DA195.tmp\setup.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ro.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_arm64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_iw.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_vi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en-GB.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_id.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_id.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fil.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_iw.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lt.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lt.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine_arm64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_da.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_et.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_da.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ms.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ja.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_de.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_uk.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_th.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_de.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ms.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_gu.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_gu.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ko.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_th.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ml.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_no.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_cs.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_es-419.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ur.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_is.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-PT.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ml.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_it.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es-419.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sw.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sk.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdate.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_zh-TW.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hu.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ta.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hi.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_am.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_vi.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pt-BR.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateBroker.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_nl.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandlerArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ro.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fil.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_arm64.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ar.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShellArm64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bg.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_mr.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ar.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_el.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_te.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ru.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_tr.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser_64.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fa.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ca.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ca.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_kn.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bg.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler64.exeJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bn.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateCore.exeJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sv.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_zh-CN.dllJump to dropped file
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeDropped PE file which has not been started: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fa.dllJump to dropped file
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeEvasive API call chain: RegOpenKey,DecisionNodes,ExitProcess
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeAPI coverage: 10.0 %
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe TID: 2700Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe TID: 1612Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7212Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AAD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00AAD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009AD9B3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_009AD9B3
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A341D68 FindFirstFileExW,4_2_00007FF65A341D68
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_00076405 FindFirstFileExW,14_2_00076405
Source: BraveUpdate.exe, 0000000C.00000003.2371561745.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2384037417.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2379074521.0000000000B70000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8
Source: ie_to_edge_stub.exe, 00000013.00000002.1902842061.00000182A3213000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: BraveUpdate.exe, 00000001.00000003.2330731019.00000000008A8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: BraveUpdate.exe, 0000000A.00000003.1785090209.000000000129F000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000002.2087056339.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000003.1785090209.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000A.00000002.2087056339.00000000012A2000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000003.2371561745.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 0000000C.00000002.2384939079.0000000000B94000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3584873691.000001652FC5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3581308358.000001652A62B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3579229843.0000013F42DD1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45BB1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: iexplore.exe, 00000010.00000002.3583011185.0000013F45BB1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWJL`?
Source: BraveUpdate.exe, 0000000C.00000002.2383624779.0000000000B08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SeE
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_0098DA04 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0098DA04
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A334CE8 InitializeCriticalSectionAndSpinCount,GetLastError,IsDebuggerPresent,OutputDebugStringW,4_2_00007FF65A334CE8
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A333A10 LoadLibraryW,GetProcAddress,FreeLibrary,4_2_00007FF65A333A10
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_0098A026 mov ecx, dword ptr fs:[00000030h]0_2_0098A026
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_0098F38C mov eax, dword ptr fs:[00000030h]0_2_0098F38C
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AAD6A1 mov eax, dword ptr fs:[00000030h]1_2_00AAD6A1
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AABEF8 mov ecx, dword ptr fs:[00000030h]1_2_00AABEF8
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009AD6A1 mov eax, dword ptr fs:[00000030h]2_2_009AD6A1
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009ABEF8 mov ecx, dword ptr fs:[00000030h]2_2_009ABEF8
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_00074C52 mov ecx, dword ptr fs:[00000030h]14_2_00074C52
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_0007726A mov eax, dword ptr fs:[00000030h]14_2_0007726A
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_009811D5 GetProcessHeap,__Init_thread_footer,__Init_thread_footer,0_2_009811D5
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess token adjusted: Debug
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeProcess token adjusted: Debug
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00987190 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00987190
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_0098DA04 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0098DA04
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00986D06 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00986D06
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00986E9A SetUnhandledExceptionFilter,0_2_00986E9A
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AAB83E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00AAB83E
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AA7D47 SetUnhandledExceptionFilter,1_2_00AA7D47
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AA7A8E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00AA7A8E
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeCode function: 1_2_00AA7BB0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00AA7BB0
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009AB83E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_009AB83E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009A7D47 SetUnhandledExceptionFilter,2_2_009A7D47
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009A7A8E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_009A7A8E
Source: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exeCode function: 2_2_009A7BB0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_009A7BB0
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A335B78 SetUnhandledExceptionFilter,4_2_00007FF65A335B78
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A33B4C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF65A33B4C8
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A335994 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF65A335994
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exeCode function: 4_2_00007FF65A3355DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF65A3355DC
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_00071850 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_00071850
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_00075D94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_00075D94
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_000719E4 SetUnhandledExceptionFilter,14_2_000719E4
Source: C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exeCode function: 14_2_00071AF5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_00071AF5

HIPS / PFW / Operating System Protection Evasion

barindex
Benign windows process drops PE files
Source: C:\Windows\System32\svchost.exeFile created: BIT5671.tmp.13.drJump to dropped file
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{F9C0986C-4663-4345-B1A7-EBA6677905FE}Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "c:\program files (x86)\bravesoftware\update\braveupdate.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjpbwfoysigdxbkyxrlcnzlcnnpb249ijeumy4znjeumtq1iibzagvsbf92zxjzaw9upsixljmumzyxlje0nsigaxntywnoaw5lpsixiibzzxnzaw9uawq9intgoumwotg2qy00njyzltqzndutqjfbny1fqke2njc3ota1rkv9iibpbnn0ywxsc291cmnlpsj0ywdnzwrtasigdgvzdhnvdxjjzt0iyxv0byigcmvxdwvzdglkpsj7rtc5ntuyneytoeu0qi00ruywltgyouutoezeqkzfodfdnti4fsigzgvkdxa9imnyiibkb21haw5qb2luzwq9ijaipjxodybwahlzbwvtb3j5psi4iibzc2u9ijeiihnzzti9ijeiihnzztm9ijeiihnzc2uzpsixiibzc2u0mt0imsigc3nlndi9ijeiigf2ed0imsivpjxvcybwbgf0zm9ybt0id2luiib2zxjzaw9upsixmc4wlje5mdq1ljiwmdyiihnwpsiiigfyy2g9ing2ncivpjxhchagyxbwawq9intcmtmxqzkzns05qku2ltqxreetotu5os0xrjc3nkjfqjgwmtl9iib2zxjzaw9upsiiig5lehr2zxjzaw9upsixljmumzyxlje0nsigbgfuzz0iiibicmfuzd0iiibjbgllbnq9iii-pgv2zw50igv2zw50dhlwzt0imiigzxzlbnryzxn1bhq9ijeiigvycm9yy29kzt0imcigzxh0cmfjb2rlmt0imcigaw5zdgfsbf90aw1lx21zpsi0odi4ii8-pc9hcha-pc9yzxf1zxn0pg
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe c:\program files (x86)\bravesoftware\update\braveupdate.exe" /handoff "appguid={afe6a462-c574-4b8a-af43-4cc60df4563b}&appname=brave-release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{f9c0986c-4663-4345-b1a7-eba6677905fe}
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe "c:\program files (x86)\bravesoftware\update\braveupdate.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjpbwfoysigdxbkyxrlcnzlcnnpb249ijeumy4znjeumtq1iibzagvsbf92zxjzaw9upsixljmumzyxlje0nsigaxntywnoaw5lpsixiibzzxnzaw9uawq9intgoumwotg2qy00njyzltqzndutqjfbny1fqke2njc3ota1rkv9iibpbnn0ywxsc291cmnlpsj0ywdnzwrtasigdgvzdhnvdxjjzt0iyxv0byigcmvxdwvzdglkpsj7rtc5ntuyneytoeu0qi00ruywltgyouutoezeqkzfodfdnti4fsigzgvkdxa9imnyiibkb21haw5qb2luzwq9ijaipjxodybwahlzbwvtb3j5psi4iibzc2u9ijeiihnzzti9ijeiihnzztm9ijeiihnzc2uzpsixiibzc2u0mt0imsigc3nlndi9ijeiigf2ed0imsivpjxvcybwbgf0zm9ybt0id2luiib2zxjzaw9upsixmc4wlje5mdq1ljiwmdyiihnwpsiiigfyy2g9ing2ncivpjxhchagyxbwawq9intcmtmxqzkzns05qku2ltqxreetotu5os0xrjc3nkjfqjgwmtl9iib2zxjzaw9upsiiig5lehr2zxjzaw9upsixljmumzyxlje0nsigbgfuzz0iiibicmfuzd0iiibjbgllbnq9iii-pgv2zw50igv2zw50dhlwzt0imiigzxzlbnryzxn1bhq9ijeiigvycm9yy29kzt0imcigzxh0cmfjb2rlmt0imcigaw5zdgfsbf90aw1lx21zpsi0odi4ii8-pc9hcha-pc9yzxf1zxn0pgJump to behavior
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeProcess created: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe c:\program files (x86)\bravesoftware\update\braveupdate.exe" /handoff "appguid={afe6a462-c574-4b8a-af43-4cc60df4563b}&appname=brave-release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{f9c0986c-4663-4345-b1a7-eba6677905fe}Jump to behavior
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00986FA5 cpuid 0_2_00986FA5
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exeCode function: 0_2_00986BF6 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00986BF6
Source: C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe DisableExceptionChainValidationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts14
Command and Scripting Interpreter		1
Scheduled Task/Job		111
Process Injection		12
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Scheduled Task/Job		11
Registry Run Keys / Startup Folder		1
Scheduled Task/Job		2
Virtualization/Sandbox Evasion		LSASS Memory1
Query Registry		Remote Desktop Protocol2
Clipboard Data		1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts231
Native API		1
DLL Side-Loading		11
Registry Run Keys / Startup Folder		1
Disable or Modify Tools		Security Account Manager41
Security Software Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts11
Exploitation for Client Execution		1
Image File Execution Options Injection		1
DLL Side-Loading		111
Process Injection		NTDS2
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
Image File Execution Options Injection		1
Deobfuscate/Decode Files or Information		LSA Secrets1
Process Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
Obfuscated Files or Information		Cached Domain Credentials1
Account Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading		DCSync2
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem133
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1408821 Sample: BraveBrowserSetup-BRV002.exe Startdate: 14/03/2024 Architecture: WINDOWS Score: 51 155 Found evasive API chain (may stop execution after checking volume information) 2->155 157 Downloads suspicious files via Chrome 2->157 10 BraveBrowserSetup-BRV002.exe 1 79 2->10         started        14 BraveUpdateOnDemand.exe 2->14         started        16 svchost.exe 2->16         started        19 6 other processes 2->19 process3 dnsIp4 109 C:\Program Files (x86)\...\BraveUpdate.exe, PE32 10->109 dropped 111 C:\Program Files (x86)\...\psuser_arm64.dll, PE32+ 10->111 dropped 113 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 10->113 dropped 123 69 other files (none is malicious) 10->123 dropped 163 Found evasive API chain checking for user administrative privileges 10->163 21 BraveUpdate.exe 17 78 10->21         started        25 BraveUpdate.exe 14->25         started        125 108.139.47.77 AMAZON-02US United States 16->125 127 104.76.104.139 AKAMAI-ASUS United States 16->127 129 127.0.0.1 unknown unknown 16->129 115 {21DA6F9B-FFAF-40C...ller-x64.exe (copy), PE32+ 16->115 dropped 117 C:\Users\user\AppData\Local\...\BIT5671.tmp, PE32+ 16->117 dropped 165 Benign windows process drops PE files 16->165 119 C:\...\brave_installer-x64.exe, PE32+ 19->119 dropped 121 C:\...\brave_installer-x64.exe, PE32+ 19->121 dropped 27 BraveUpdate.exe 19->27         started        29 BraveUpdate.exe 19->29         started        31 brave_installer-x64.exe 19->31         started        33 2 other processes 19->33 file5 signatures6 process7 file8 91 C:\Program Files (x86)\...\BraveUpdate.exe, PE32 21->91 dropped 93 C:\Program Files (x86)\...\psuser_arm64.dll, PE32+ 21->93 dropped 95 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 21->95 dropped 99 70 other files (none is malicious) 21->99 dropped 159 Creates an undocumented autostart registry key 21->159 35 BraveUpdate.exe 188 21->35         started        37 BraveUpdate.exe 21->37         started        40 BraveUpdate.exe 52 21->40         started        42 BraveUpdate.exe 21->42         started        44 iexplore.exe 25->44         started        46 BraveUpdateOnDemand.exe 27->46         started        48 iexplore.exe 27->48         started        50 iexplore.exe 29->50         started        97 C:\Program Files (x86)\...\setup.exe, PE32+ 31->97 dropped signatures9 process10 dnsIp11 52 BraveUpdateComRegisterShell64.exe 6 35->52         started        54 BraveUpdateComRegisterShell64.exe 6 35->54         started        56 BraveUpdateComRegisterShell64.exe 67 35->56         started        137 13.225.214.84 AMAZON-02US United States 37->137 139 13.107.21.200 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 44->139 58 ie_to_edge_stub.exe 44->58         started        60 iexplore.exe 44->60         started        63 iexplore.exe 44->63         started        67 5 other processes 44->67 65 BraveUpdate.exe 46->65         started        process12 dnsIp13 69 msedge.exe 58->69         started        143 23.41.170.208 ZAYO-6461US United States 60->143 145 20.110.205.119 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 60->145 151 6 other IPs or domains 60->151 74 ie_to_edge_stub.exe 60->74         started        76 ssvagent.exe 60->76         started        78 ssvagent.exe 63->78         started        80 iexplore.exe 65->80         started        147 20.189.173.12 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 67->147 149 151.101.193.108 FASTLYUS United States 67->149 153 3 other IPs or domains 67->153 process14 dnsIp15 141 239.255.255.250 unknown Reserved 69->141 101 C:\Users\user\AppData\...\content_new.js, Unicode 69->101 dropped 103 C:\Users\user\AppData\Local\...\content.js, Unicode 69->103 dropped 105 C:\Users\user\...\page_embed_script.js, ASCII 69->105 dropped 107 C:\Users\user\...\eventpage_bin_prod.js, ASCII 69->107 dropped 161 Maps a DLL or memory area into another process 69->161 82 msedge.exe 69->82         started        85 msedge.exe 69->85         started        87 identity_helper.exe 69->87         started        89 identity_helper.exe 69->89         started        file16 signatures17 process18 dnsIp19 131 13.107.21.239 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 82->131 133 13.107.246.40 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 82->133 135 7 other IPs or domains 82->135

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
BraveBrowserSetup-BRV002.exe3%ReversingLabs
BraveBrowserSetup-BRV002.exe1%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler64.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandlerArm64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandlerArm64.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe1%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateBroker.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateBroker.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShell64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShell64.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShellArm64.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShellArm64.exe0%VirustotalBrowse
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateCore.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateOnDemand.exe0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateSetup.exe3%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdate.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_am.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ar.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bg.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bn.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ca.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_cs.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_da.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_de.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_el.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en-GB.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_es-419.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_es.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_et.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fa.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fi.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fil.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fr.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_gu.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hi.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hr.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hu.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_id.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_is.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_it.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_iw.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ja.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_kn.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ko.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lt.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lv.dll0%ReversingLabs
C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ml.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
http://www.chennaionline.com/ncommon/images/collogo.ico##p0%Avira URL Cloudsafe
http://search.books.com.tw/favicon.icoT0%Avira URL Cloudsafe
http://www.merlin.com.pl/favicon.ico0%Avira URL Cloudsafe
http://www.dailymail.co.uk/0%Avira URL Cloudsafe
https://updates.bravesoftware.com/service/update20%Avira URL Cloudsafe
https://www.kindafrugal.com/23-ways-to-reduce-housing-costs/0%Avira URL Cloudsafe
http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea0%Avira URL Cloudsafe
http://www.chennaionline.com/ncommon/images/collogo.ico##p0%VirustotalBrowse
https://www.profootballnetwork.com/kansas-city-chiefs-news-march-13-2024/0%Avira URL Cloudsafe
https://www.kindafrugal.com/23-ways-to-reduce-housing-costs/0%VirustotalBrowse
https://updates.bravesoftware.com/service/update20%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW0%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW0%Avira URL Cloudsafe
http://www.merlin.com.pl/favicon.ico0%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS50%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS60%Avira URL Cloudsafe
https://www.profootballnetwork.com/kansas-city-chiefs-news-march-13-2024/0%VirustotalBrowse
http://www.google.co.uk/xH0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS50%VirustotalBrowse
http://busca.estadao.com.br/favicon.icojAf;0%Avira URL Cloudsafe
http://busca.igbusca.com.br//app/static/images/favicon.ico0%Avira URL Cloudsafe
http://www.etmall.com.tw/favicon.ico0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS60%VirustotalBrowse
http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea0%VirustotalBrowse
http://search.hanafos.com/favicon.ico0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=0%Avira URL Cloudsafe
http://buscar.ozu.es/0%Avira URL Cloudsafe
http://www.dailymail.co.uk/0%VirustotalBrowse
http://search.auction.co.kr/0%Avira URL Cloudsafe
http://search.hanafos.com/favicon.ico0%VirustotalBrowse
https://updates.bravesoftware.com:443/service/update20%Avira URL Cloudsafe
http://buscar.ozu.es/0%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=0%VirustotalBrowse
http://searh.goo.ne.jp/fav0%Avira URL Cloudsafe
http://search.auction.co.kr/0%VirustotalBrowse
http://browse.guardian.co.uk/favicon.ico0%Avira URL Cloudsafe
http://google.pchome.com.tw/0%Avira URL Cloudsafe
https://updates.bravesoftware.com:443/service/update20%VirustotalBrowse
http://www.etmall.com.tw/favicon.ico0%VirustotalBrowse
http://search.atlas.cz/I0%Avira URL Cloudsafe
http://www.ozu.es/favicon.ico0%Avira URL Cloudsafe
http://busca.igbusca.com.br//app/static/images/favicon.ico0%VirustotalBrowse
http://search.yahoo.co.jp/favicon.ico0%Avira URL Cloudsafe
http://browse.guardian.co.uk/favicon.ico0%VirustotalBrowse
http://www.gmarket.co.kr/0%Avira URL Cloudsafe
http://www.arrakis.com/favicon.icoeI0%Avira URL Cloudsafe
http://www.ozu.es/favicon.ico0%VirustotalBrowse
http://search.yahoo.co.jp/favicon.ico0%VirustotalBrowse
https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%0%Avira URL Cloudsafe
http://search.gamer.com.tw/favicon.icot0%Avira URL Cloudsafe
http://search.orange.co.uk/favicon.ico0%Avira URL Cloudsafe
http://www.iask.com/0%Avira URL Cloudsafe
http://www.news.com.au/favicon.ico0%Avira URL Cloudsafe
https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%0%VirustotalBrowse
http://search.orange.co.uk/favicon.ico0%VirustotalBrowse
http://google.pchome.com.tw/0%VirustotalBrowse
http://www.iask.com/0%VirustotalBrowse
http://www.news.com.au/favicon.ico0%VirustotalBrowse
http://www.gmarket.co.kr/0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.hollywoodreporter.com/tv/tv-news/robyn-bernard-dead-general-hospital-actress-1235852051/me[1].json.32.drfalse
    		high
    http://search.chol.com/favicon.icoiexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      http://www.merlin.com.pl/favicon.icoiexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      http://www.dailymail.co.uk/iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      https://www.msn.com/8iexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-darkme[1].json.46.drfalse
          		high
          http://search-dyn.tiscali.it/4iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://deff.nelreports.net/api/report?cat=msniexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45D52000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            		unknown
            https://updates.bravesoftware.com/service/update2BraveUpdate.exe, 0000000C.00000002.2384037417.0000000000B43000.00000004.00000020.00020000.00000000.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://search.books.com.tw/favicon.icoTiexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://fr.search.yahoo.com/iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://g.live.com/odclientsettings/Prod.C:svchost.exe, 0000000D.00000003.1798007535.000001652FC0A000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                http://in.search.yahoo.com/iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://www.chennaionline.com/ncommon/images/collogo.ico##piexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                  • 0%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.kindafrugal.com/23-ways-to-reduce-housing-costs/me[1].json.32.drfalse
                  • 0%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  		unknown
                  http://img.shopzilla.com/shopzilla/shopzilla.icoiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45AB6000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSeaiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45AB6000.00000004.00000020.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://android.notify.windows.com/iOSxiexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://www.profootballnetwork.com/kansas-city-chiefs-news-march-13-2024/me[1].json.46.drfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPWiexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS5iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.soso.com/$iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://www.yardbarker.com/entertainment/articles/the_best_and_worst_films_of_2023_so_far_110823/s1_me[1].json.46.drfalse
                          		high
                          http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS6iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          https://www.msn.com/favicon.icoOiexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://www.google.co.uk/xHiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://msk.afisha.ru/iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://busca.estadao.com.br/favicon.icojAf;iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.reddit.com/iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://busca.igbusca.com.br//app/static/images/favicon.icoiexplore.exe, 00000010.00000003.1921283681.0000013F45AB6000.00000004.00000020.00020000.00000000.sdmpfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                		unknown
                                https://www.msn.com/favicon.icoAiexplore.exe, 00000010.00000002.3583011185.0000013F45D0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.ya.com/favicon.icoiexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://search.cn.yahoo.com/Yiexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.etmall.com.tw/favicon.icoiexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • 0%, Virustotal, Browse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://search.hanafos.com/favicon.icoiexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • 0%, Virustotal, Browse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://asp.usatoday.com/U;iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.msn.com/?ocid=iehpstiexplore.exe, 00000010.00000002.3587038633.0000013F4948A000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://es.ask.com/1Aiexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.msn.com/caliexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://search.ebay.com/favicon.icoXiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.yardbarker.com/entertainment/articles/20_films_with_the_most_memorable_twist_endings_101me[1].json.46.drfalse
                                                  		high
                                                  http://search.msn.co.jp/results.aspx?q=iexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://buscar.ozu.es/iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://www.msn.com/favicon.icokiexplore.exe, 00000010.00000002.3578137247.000000257C6F6000.00000004.00000010.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.msn.com/favicon.icoiiexplore.exe, 00000010.00000002.3587038633.0000013F49252000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://search.live.com/results.aspx?FORM=SOLTDF&q=iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.si.com/nfl/steelers/news/former-pittsburgh-steelers-mason-rudolph-signs-titansme[1].json.32.drfalse
                                                          		high
                                                          http://www.google.it/iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.mmamania.com/2024/3/13/24099921/mark-coleman-update-intubated-ufc-vet-somewhat-consciousme[1].json.32.drfalse
                                                              		high
                                                              http://www.amazon.de/LHv;iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://search.auction.co.kr/iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • 0%, Virustotal, Browse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://www.msn.com/?ocid=iehpp/?LinkId=255141IE8SRCiexplore.exe, 00000010.00000002.3583011185.0000013F45C10000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3583011185.0000013F45CE2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://updates.bravesoftware.com:443/service/update2BraveUpdate.exe, 0000000A.00000002.2086951587.0000000001268000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • 0%, Virustotal, Browse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://sads.myspace.com/iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.msn.com/en-us/community/channel/vid-cj9pqbr0vn9in2b6ddcd8sfgpfq6x6utp44fssrv6mc2gtybw0usme[1].json.46.drfalse
                                                                      		high
                                                                      http://searh.goo.ne.jp/faviexplore.exe, 00000010.00000002.3585069476.0000013F45E63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      http://list.taobao.com/browse/search_visual.htm?n=15&q=iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://apnews.com/article/north-korea-kim-tank-training-us-south-244d613ea6dfaa0a38cffcb3dddc8f06me[1].json.32.drfalse
                                                                          		high
                                                                          http://price.ru/favicon.icotiexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://browse.guardian.co.uk/favicon.icoiexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • 0%, Virustotal, Browse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://recherche.tf1.fr/favicon.ico=iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://chrome.google.com/webstore/manifest.json.22.drfalse
                                                                                		high
                                                                                http://google.pchome.com.tw/iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • 0%, Virustotal, Browse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.rambler.ru/favicon.icoiexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://search.atlas.cz/Iiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://uk.search.yahoo.com/iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.ozu.es/favicon.icoiexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • 0%, Virustotal, Browse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://search.sify.com/iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://openimage.interpark.com/interpark.icoiexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://search.yahoo.co.jp/favicon.icoiexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • 0%, Virustotal, Browse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          http://www.gmarket.co.kr/iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AC6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • 0%, Virustotal, Browse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          http://search.nifty.com/iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.google.si/iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.myspace.com/favicon.ico&Diexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.arrakis.com/favicon.icoeIiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                http://www.soso.com/iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.msn.com/?ocid=iehprosofthpiexplore.exe, 00000010.00000002.3583011185.0000013F45D75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://asp.usatoday.com/favicon.ico&iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://updates.bravesoftware.com/service/check2/recover&appid=%s&appversion=%s&applang=%s&machine=%BraveBrowserSetup-BRV002.exe, 00000000.00000003.1711552873.000000000274F000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1713122350.0000000002F58000.00000004.00000020.00020000.00000000.sdmp, BraveBrowserSetup-BRV002.exe, 00000000.00000003.1709838834.000000000274A000.00000004.00000020.00020000.00000000.sdmp, BraveUpdate.exe, 00000001.00000003.1729077802.00000000008BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • 0%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://cnweb.search.live.com/results.aspx?q=iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922034906.0000013F45AD5000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AD6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.msn.com/favicon.icod=iehpiexplore.exe, 00000010.00000002.3587038633.0000013F493EA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3587038633.0000013F492B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.twitter.com/iexplore.exe, 00000010.00000002.3587038633.0000013F4925F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.ceneo.pl/favicon.icoGiexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=%7Breferrer:source?%7D&Form=IE8SRCiexplore.exe, 00000010.00000002.3585069476.0000013F45DBF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://home.altervista.org/favicon.icoQiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://search.gamer.com.tw/favicon.icotiexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922322439.0000013F45AE4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  http://search.orange.co.uk/favicon.icoiexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582600932.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  • 0%, Virustotal, Browse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  http://www.iask.com/iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  • 0%, Virustotal, Browse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  http://search.ebay.com/favicon.ico-II;iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://vachercher.lycos.fr/;;iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.msn.com/?ocid=iehpp/?LinkId=255141Listiexplore.exe, 00000010.00000002.3587038633.0000013F49220000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://search.centrum.cz/favicon.icoiexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://busca.orange.es/=;iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582689709.0000013F45ABE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1922144806.0000013F45ABD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921283681.0000013F45ABB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://www.msn.com/favicon.icod=iehpfaultiexplore.exe, 00000010.00000002.3587038633.0000013F4941E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://ariadna.elmundo.es/iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://www.news.com.au/favicon.icoiexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • 0%, Virustotal, Browse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                http://www.cdiscount.com/iexplore.exe, 00000010.00000003.1920299538.0000013F45AAF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582440232.0000013F45AB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://it.search.yahoo.com/iexplore.exe, 00000010.00000003.1922228099.0000013F45ADD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582831869.0000013F45AE2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1921818983.0000013F45AD8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://www.ceneo.pl/favicon.icoiexplore.exe, 00000010.00000003.1919966038.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920248805.0000013F45ABA000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919331696.0000013F45ACC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000002.3582766206.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1919821940.0000013F45AB7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000010.00000003.1920392083.0000013F45AD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high

                                                                                                                                      World Map of Contacted IPs

                                                                                                                                      • No. of IPs < 25%
                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                      • 75% < No. of IPs

                                                                                                                                      Public IPs

                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                      23.44.201.19
                                                                                                                                      		unknownUnited States
                                                                                                                                      		20940AKAMAI-ASN1EUfalse
                                                                                                                                      23.41.170.208
                                                                                                                                      		unknownUnited States
                                                                                                                                      		6461ZAYO-6461USfalse
                                                                                                                                      204.79.197.200
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      13.107.246.40
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      151.101.193.108
                                                                                                                                      		unknownUnited States
                                                                                                                                      		54113FASTLYUSfalse
                                                                                                                                      13.107.21.200
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      152.195.19.97
                                                                                                                                      		unknownUnited States
                                                                                                                                      		15133EDGECASTUSfalse
                                                                                                                                      20.189.173.12
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      108.139.47.77
                                                                                                                                      		unknownUnited States
                                                                                                                                      		16509AMAZON-02USfalse
                                                                                                                                      23.44.129.46
                                                                                                                                      		unknownUnited States
                                                                                                                                      		20940AKAMAI-ASN1EUfalse
                                                                                                                                      151.101.66.137
                                                                                                                                      		unknownUnited States
                                                                                                                                      		54113FASTLYUSfalse
                                                                                                                                      20.110.205.119
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      172.64.41.3
                                                                                                                                      		unknownUnited States
                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                      108.139.47.108
                                                                                                                                      		unknownUnited States
                                                                                                                                      		16509AMAZON-02USfalse
                                                                                                                                      142.250.65.234
                                                                                                                                      		unknownUnited States
                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                      23.209.72.7
                                                                                                                                      		unknownUnited States
                                                                                                                                      		20940AKAMAI-ASN1EUfalse
                                                                                                                                      1.1.1.1
                                                                                                                                      		unknownAustralia
                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                      104.76.104.139
                                                                                                                                      		unknownUnited States
                                                                                                                                      		16625AKAMAI-ASUSfalse
                                                                                                                                      13.107.21.239
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      52.123.251.24
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      142.250.80.97
                                                                                                                                      		unknownUnited States
                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                      142.251.40.142
                                                                                                                                      		unknownUnited States
                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                      20.50.80.213
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      239.255.255.250
                                                                                                                                      		unknownReserved
                                                                                                                                      		unknownunknownfalse
                                                                                                                                      23.44.129.36
                                                                                                                                      		unknownUnited States
                                                                                                                                      		20940AKAMAI-ASN1EUfalse
                                                                                                                                      13.225.214.84
                                                                                                                                      		unknownUnited States
                                                                                                                                      		16509AMAZON-02USfalse
                                                                                                                                      204.79.197.203
                                                                                                                                      		unknownUnited States
                                                                                                                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                                                                                                                                      Private

                                                                                                                                      IP
                                                                                                                                      127.0.0.1

                                                                                                                                      General Information

                                                                                                                                      Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                      Analysis ID:1408821
                                                                                                                                      Start date and time:2024-03-14 09:24:22 +01:00
                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                      Overall analysis duration:0h 12m 39s
                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                      Report type:full
                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                      Run name:Run with higher sleep bypass
                                                                                                                                      Number of analysed new started processes analysed:50
                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                      Technologies:
                                                                                                                                      • HCA enabled
                                                                                                                                      • EGA enabled
                                                                                                                                      • AMSI enabled
                                                                                                                                      Analysis Mode:default
                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                      Sample name:BraveBrowserSetup-BRV002.exe
                                                                                                                                      Detection:MAL
                                                                                                                                      Classification:mal51.evad.winEXE@107/555@0/28
                                                                                                                                      EGA Information:
                                                                                                                                      • Successful, ratio: 60%
                                                                                                                                      HCA Information:
                                                                                                                                      • Successful, ratio: 94%
                                                                                                                                      • Number of executed functions: 74
                                                                                                                                      • Number of non-executed functions: 108
                                                                                                                                      Cookbook Comments:
                                                                                                                                      • Found application associated with file extension: .exe
                                                                                                                                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                      Warnings

                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
                                                                                                                                      • Execution Graph export aborted for target BraveUpdate.exe, PID 7316 because there are no executed function
                                                                                                                                      • Execution Graph export aborted for target BraveUpdate.exe, PID 8524 because there are no executed function
                                                                                                                                      • Execution Graph export aborted for target BraveUpdate.exe, PID 8608 because there are no executed function
                                                                                                                                      • Execution Graph export aborted for target BraveUpdate.exe, PID 9032 because there are no executed function
                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                      • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                      • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                      • Report size getting too big, too many NtSetValueKey calls found.
                                                                                                                                      • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                      • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                                      Simulations

                                                                                                                                      Behavior and APIs

                                                                                                                                      TimeTypeDescription
                                                                                                                                      08:25:22Task SchedulerRun new task: BraveSoftwareUpdateTaskMachineCore{B531CD99-464C-4AB4-863D-706CD5F5CECD} path: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe s>/c
                                                                                                                                      08:25:22Task SchedulerRun new task: BraveSoftwareUpdateTaskMachineUA{1987AD2C-A2A3-4D81-BB5D-D496399993F2} path: C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe s>/ua /installsource scheduler
                                                                                                                                      08:25:49AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                                                                      08:25:58AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                                                                      08:26:17AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run BraveVpnWireguardService "C:\Program Files\BraveSoftware\Brave-Browser\Application\122.1.63.174\BraveVpnWireguardService\brave_vpn_wireguard_service.exe" --interactive

                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                      IPs

                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                      23.41.170.208https://stackauth-bainlk.cz/save/sharefile/Get hashmaliciousUnknownBrowse
                                                                                                                                        CMhm5cLiET.exeGet hashmaliciousAmadey, Glupteba, Mystic Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                          204.79.197.200kr.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                          • /
                                                                                                                                          13.107.246.40https://ecv.microsoft.com/F5w9LBSgNJGet hashmaliciousUnknownBrowse
                                                                                                                                            https://wanlixing168.com/Get hashmaliciousUnknownBrowse
                                                                                                                                              https://lookerstudio.google.com/s/l3M3K3X4dggGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                https://assets-usa.mkt.dynamics.com/eafd3d58-f4cb-ee11-9073-6045bd050506/digitalassets/standaloneforms/a5094c23-a3e0-ee11-904c-6045bd02a830Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                  https://gallow-drains.uk/ft.PDFGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                    https://myworkspaceb1b7b.myclickfunnels.com/productivity--34e3cGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                      https://ac960a83.98dfdec9708f8c543cf6300e.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                        https://1drv.ms/o/s!AmFI0faGJpjZg35FRLRrKG6MdZp9?e=sWdNbFGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                          https://call.voipmessage.uk/XWDB1L08rMnRybENhbDh2U1ZoL0I3djZLdlBSUm5TSDl3UGp3UkNta2lsWk5hdDlaRVBoT3NoUVlSYW1teUJ1NGV4MXhoY1h1SlFhOE1JaVNWVE5KRUFhelI5ZWZqWTlBNnFTZlpLVll6TGFXak82MGhmUEtHd0Nzai9PSXRoNXRhZjFIcm9LTkxlbldwbDMyM3I5c2NZWWoycExEV3BWUjZKTEVyNTF4TmdkQ2hybWtVWWpHTWxDMlFwbEQ1SU0rckJsYkFkZHZRczMvWlpLZG02dz0tLW1mRE9veS9iekxneXNEM2YtLVZpVDhZU2QvUElQb3pNZ3UrdUQ2UXc9PQ==?cid=233840338Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                            Payment Advice Copy.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                              151.101.193.108TO92l1miUYGet hashmaliciousUnknownBrowse
                                                                                                                                                                https://file.io/RqcRlWKFS2O2Get hashmaliciousUnknownBrowse
                                                                                                                                                                  https://k-e-v.no/?s=%22%2F%3C%2Fscript%3E%3Cscript%3Ewindow%5B%27location%27%5D%5B%27replace%27%5D%28%5B%27h%27%2C%27t%27%2C%27t%27%2C%27p%27%2C%27s%27%2C%27%3A%27%2C%27%2F%27%2C%27%2F%27%2C%27w%27%2C%27w%27%2C%27w%27%2C%27.%27%2C%27w%27%2C%27h%27%2C%27t%27%2C%27e%27%2C%27n%27%2C%27v%27%2C%27l%27%2C%27p%27%2C%27e%27%2C%27.%27%2C%27c%27%2C%27o%27%2C%27m%27%2C%27%2F%27%2C%27a%27%2C%27c%27%2C%27T%27%2C%27c%27%2C%27l%27%2C%272%27%2C%27k%27%2C%27T%27%2C%27m%27%2C%27P%27%2C%27S%27%2C%27J%27%2C%27i%27%2C%27_%27%2C%27L%27%2C%27d%27%2C%27_%27%2C%27m%27%2C%27h%27%2C%27p%27%2C%27L%27%2C%27w%27%2C%27y%27%2C%27Z%27%2C%27e%27%2C%27d%27%2C%27s%27%2C%27u%27%2C%27P%27%2C%27V%27%2C%27d%27%2C%275%27%2C%275%27%2C%27q%27%2C%27f%27%2C%27t%27%2C%27s%27%2C%272%27%2C%27r%27%2C%27Y%27%2C%27e%27%2C%27_%27%2C%27S%27%2C%27b%27%2C%27Q%27%2C%27X%27%2C%271%27%2C%27b%27%2C%27Z%27%2C%27F%27%2C%27Q%27%2C%27T%27%2C%27N%27%2C%27z%27%2C%27T%27%2C%271%27%2C%27A%27%2C%27s%27%2C%27c%27%2C%27d%27%2C%27I%27%2C%27I%27%2C%27X%27%2C%27G%27%2C%27w%27%2C%27i%27%2C%27c%27%2C%27D%27%2C%27t%27%2C%27e%27%2C%27y%27%2C%27V%27%2C%27V%27%2C%278%27%2C%27v%27%2C%27Z%27%2C%27E%27%2C%27f%27%2C%27f%27%2C%27Y%27%2C%27C%27%2C%27e%27%2C%27o%27%2C%27Y%27%2C%27X%27%2C%27g%27%2C%27~%27%2C%27~%27%5D%5B%27join%27%5D%28%27%27%29%29%2Cdocument%5B%27body%27%5D%5B%27style%27%5D%5B%27opacity%27%5D%3D0x0%3B%3C%2Fscript%3EGet hashmaliciousUnknownBrowse
                                                                                                                                                                    https://www.tbsnews.net/coronavirus-chronicle/covid-19-bangladesh/private-hospitals-allegedly-overcharging-covid-19-test,Get hashmaliciousUnknownBrowse
                                                                                                                                                                      https://in.xero.com/2wXRHMinS61wphFklre8FF5FmAhBF8wVVKcXareO?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=classicInvoicesEmailV2ExperimentControl&d=DwMFaQGet hashmaliciousUnknownBrowse
                                                                                                                                                                        https://giant-cheese-ac6.notion.site/Civilmart-3a33da23353c4ee882b9d5f015d2df1d?pvs=4Get hashmaliciousUnknownBrowse
                                                                                                                                                                          http://zpr.io/YhnsXsPMktKBGet hashmaliciousUnknownBrowse
                                                                                                                                                                            Incoming_Payment.svgGet hashmaliciousAMSIReaper, AgentTesla, HTMLPhisherBrowse
                                                                                                                                                                              https://far-skateboard-ba2.notion.site/GAFFNEY-Electrical-Services-Pty-Ltd-4f330ac7f10f4d20a77520190e6fd06c?pvs=4%22)%20and%20ContentType:(%221%22)Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                https://giant-brace-675.notion.site/SHAH-SMITH-ASSOCIATES-IN-a0b279071b9745139df817671a031b09Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                  13.107.21.200https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    FW EXT Serge Bozhko sent you Air Lease Corporation-VRC CH 12032024 via PandaDoc.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      https://tbyvhszminlmkuuwnrfkaos.s3.eu-west-2.amazonaws.com/url.htmlGet hashmaliciousPhisherBrowse
                                                                                                                                                                                        https://cloudflare-ipfs.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          https://prezi.com/i/view/QfiBnVYtk96znGnH43AQGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                            http://213.109.202.222/download/xml.xmlGet hashmaliciousCobaltStrikeBrowse
                                                                                                                                                                                              I4i6z8T1j9j8N5349890049902.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                https://www.jabra.com/software-and-services/jabra-directGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  http://online-aktivierung.com/volks/a1b2c3/e12ffa7c94b1e022bc6fc8a54b52e087/login/?Get hashmaliciousUnknownBrowse

                                                                                                                                                                                                    Domains

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    MICROSOFT-CORP-MSN-AS-BLOCKUShttps://ecv.microsoft.com/F5w9LBSgNJGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.107.246.40
                                                                                                                                                                                                    SecuriteInfo.com.ELF.Mirai-AJJ.2909.8691.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 20.125.16.226
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.Linux.Mirai.5666.25393.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 21.30.177.134
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.Linux.Mirai.1634.8226.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 20.136.244.165
                                                                                                                                                                                                    file.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                    • 52.168.117.173
                                                                                                                                                                                                    https://wanlixing168.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.107.246.40
                                                                                                                                                                                                    https://mtb-repo.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 52.238.253.184
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                                    • 20.189.173.22
                                                                                                                                                                                                    Dp2pX5GLaH.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.107.213.40
                                                                                                                                                                                                    FASTLYUShttps://app.getresponse.com/view.html?x=a62b&m=B0qff2&u=IkYEc&z=EC8ihl0&o=pp_5Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 151.101.193.229
                                                                                                                                                                                                    http://review--sign-documents-83.webselfsite.netGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 151.101.129.46
                                                                                                                                                                                                    https://wanlixing168.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 199.232.36.157
                                                                                                                                                                                                    https://mtb-repo.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 199.232.36.157
                                                                                                                                                                                                    https://www.mlfiqb.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 199.232.36.84
                                                                                                                                                                                                    https://www.zouxinle.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 199.232.36.84
                                                                                                                                                                                                    https://prezi.com/i/view/NEzvDMiy71AZ2uVfaGcJGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 151.101.65.44
                                                                                                                                                                                                    https://www.hrsnqub.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 199.232.36.84
                                                                                                                                                                                                    https://www.gpt-rpa.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 199.232.36.84
                                                                                                                                                                                                    AKAMAI-ASN1EUfile.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                    • 104.114.73.17
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                                    • 23.194.190.171
                                                                                                                                                                                                    https://www.guedqvr.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 104.102.251.161
                                                                                                                                                                                                    EXTERNAL New Fax received from eFax - Wednesday 13 March 2024.msgGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                                                    • 23.55.243.204
                                                                                                                                                                                                    OriginalMessage.txt.msgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                    • 23.55.243.200
                                                                                                                                                                                                    https://assets-usa.mkt.dynamics.com/eafd3d58-f4cb-ee11-9073-6045bd050506/digitalassets/standaloneforms/a5094c23-a3e0-ee11-904c-6045bd02a830Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                    • 23.219.82.81
                                                                                                                                                                                                    Kfm25WZ4Y4.rtfGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                    • 172.232.8.161
                                                                                                                                                                                                    https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 23.200.3.11
                                                                                                                                                                                                    https://www.bing.com/search?q=%e8%8f%af%e7%a2%a9+TUF+GAMING+B760M-PLUS+WIFI%e4%b8%bb%e6%a9%9f%e6%9d%bf&cvid=8ed3431d674542bbaed6934068e7242d&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyBwgJEEUY_FXSAQgxMDUwajBqNKgCALACAA&PC=U531&FPIG=7973DC1DA237417B95A39D883F2961E8&first=121&FORM=PERE2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 23.200.3.5
                                                                                                                                                                                                    ZAYO-6461UShttps://www.signerenligne.com/backend/token/selsbv3-51ebf1e3-a632-4c45-8fbd-4103b133ef9aGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 23.41.168.139
                                                                                                                                                                                                    https://ssoauth01.screenconnect.com/Bin/ScreenConnect.Client.exe?h=instance-w08c5r-relay.screenconnect.com&p=443&k=BgIAAACkAABSU0ExAAgAAAEAAQBtb%2FXciCJO5hHyAR3NG5qwkHgKE4K5jxeGBs35Nlncjh1l6g%2B23I88rvlqmL%2FU%2BHDK35q63nY%2BZ%2BacGdqbEGbCs9%2BC5ELjJTyrUFEL0gVqegeArzyszYoIS4ijuI8mGGKzW9tytW5tQhqCPuQeWdSbe0f0ttBWIUk6MfP0L7WpImwpbDzvxtmyMWSxZ8JZg39F6e1w8cQHzLH0aqJX9uvQgIvogbJB0mFXWURVi9ErahW%2BwkXWptsr99acbACeWvHhej11zT9ZPHMMaluuXTiYnS06xPJTJZglT5hvMbl15uReewBWhhwiEVa2S%2BD%2BCQEQGLsz1dpJNd543dQllUPh&s=2d10f7e2-3372-4377-b81f-4a7ead155b40&i=&e=Support&y=Guest&r=Get hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                                                    • 23.41.168.93
                                                                                                                                                                                                    P0nYO8Pr3n.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 64.124.76.140
                                                                                                                                                                                                    n5vjWNCONy.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 199.119.163.179
                                                                                                                                                                                                    p4pU29bYMV.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 209.154.84.120
                                                                                                                                                                                                    I_ CDE Awb_ 8995067407.msgGet hashmaliciousDBatLoaderBrowse
                                                                                                                                                                                                    • 23.41.168.139
                                                                                                                                                                                                    Ws9KVG1hai.lnkGet hashmaliciousROKRATBrowse
                                                                                                                                                                                                    • 23.41.168.139
                                                                                                                                                                                                    FW+Completed+EFT+-+CHK#+6760539++Weareworkspace+on+28+February+2024.emlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                    • 23.41.168.93
                                                                                                                                                                                                    I4i6z8T1j9j8N5349890049902.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 23.41.169.158
                                                                                                                                                                                                    pqP9UMkO80.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 199.119.163.187
                                                                                                                                                                                                    MICROSOFT-CORP-MSN-AS-BLOCKUShttps://ecv.microsoft.com/F5w9LBSgNJGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.107.246.40
                                                                                                                                                                                                    SecuriteInfo.com.ELF.Mirai-AJJ.2909.8691.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 20.125.16.226
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.Linux.Mirai.5666.25393.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 21.30.177.134
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.Linux.Mirai.1634.8226.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                    • 20.136.244.165
                                                                                                                                                                                                    file.exeGet hashmaliciousGlupteba, Mars Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                    • 52.168.117.173
                                                                                                                                                                                                    https://wanlixing168.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.107.246.40
                                                                                                                                                                                                    https://mtb-repo.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 52.238.253.184
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.PackedNET.2742.9443.15673.exeGet hashmaliciousGlupteba, Mars Stealer, Socks5Systemz, Stealc, VidarBrowse
                                                                                                                                                                                                    • 20.189.173.22
                                                                                                                                                                                                    Dp2pX5GLaH.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • 13.107.213.40

                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):302912
                                                                                                                                                                                                    Entropy (8bit):6.698956223631608
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:vwZfu+xXz86yji7+7tzuk3vbOtQtAO4D5eUdRx+Euqu7:GfuKXznyjiC75uk3CQtWD5Xx+ERu7
                                                                                                                                                                                                    MD5:565DAF0070618C3BBB1D486B0D5A70FA
                                                                                                                                                                                                    SHA1:3DF3AE144DB804EAF83BC0B89ED847380D476078
                                                                                                                                                                                                    SHA-256:03E2EA9C1BE863F1BD007AE03C06BF3187751A00ED0CF7C4DEB3750951E5B960
                                                                                                                                                                                                    SHA-512:DED5E2D3D3CA1198A576A0947127F584156919CAE2D67A688B90EBAF11C2AD8E2C50A494052245DB8A2423F90F037886A70AE2AE42EAF3122E1B1E53699FA176
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._[HC.:&..:&..:&..H%..:&..H#..:&.IO"..:&.IO%..:&.IO#.H:&..H"..:&..H'..:&..:'..;&..O/.@:&..O...:&..O$..:&.Rich.:&.........................PE..L......e.............................h............@..................................Q....@..........................................0...2...........N..@Q...p...$......T...................@.......h...@............................................text............................... ..`.rdata........... ..................@..@.data...t(..........................@....rsrc....2...0...4..................@..@.reloc...$...p...&...(..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandler64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):397632
                                                                                                                                                                                                    Entropy (8bit):6.440229620666291
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/+n1e0P+GDRxRwwbClZ+jam+oAI5BciIx+U:/+n1e02axRJam+S5upxn
                                                                                                                                                                                                    MD5:22DB9D0D4FEC050C0420274D3073994B
                                                                                                                                                                                                    SHA1:46FAC4589B3FCEDA6076A36CC3D3E422C05FCCDE
                                                                                                                                                                                                    SHA-256:00FF35AA88B2E1C9C271365A93B019CDD3A4ACA593642712B694628D45A12C8C
                                                                                                                                                                                                    SHA-512:C22C6656073B7EC51390D900ED40C6AACB0BB19134BD210E17E1D7A2C27069A33CAABC7AF76D50DEE6BF73EBA982F31DB8AE0509CA5690D2E4A07E675C471D1C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9.......2.........k...+...k...3...k...l.......,.......&...9..........b.......8.......8...Rich9...........PE..d...O..e.........."..........(......X..........@............................. ............`.................................................H3...........2.......,......@Q......8.......T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....6...P.......>..............@....pdata...,...........P..............@..@_RDATA...............~..............@..@.rsrc....2.......4..................@..@.reloc..8...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveCrashHandlerArm64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):372032
                                                                                                                                                                                                    Entropy (8bit):6.290860581824482
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:KfMOKV6tGrZeRIigzy/zIdNyPKxtJiD6eJj3tXPPx0t1Nosmj1c5e7QTQx+4:atAZNzif5fsm25t8x+4
                                                                                                                                                                                                    MD5:C8208EF35D885AF836E6740CB411BDB7
                                                                                                                                                                                                    SHA1:82CD43B3E74C519AB6AB9E2495C0E217F61D246A
                                                                                                                                                                                                    SHA-256:780FEDCD87E2AFC1A64EA295EA1A940EA69F74B43C625B6C85C0EECFD4142472
                                                                                                                                                                                                    SHA-512:010DD5C202E313D53DCCF86964A86D5981723A28BFD64B78752FD135DEB90763A93E04A9373136DDDB19EB6109AA540EF4E30F826DF7C02EC735A65676673A88
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.........X......X........................X......X.........N..A......A.B....A......Rich...........................PE..d...Z..e.........."..................R.........@..........................................`.................................................H........p...2...P..8....\..@Q..............T.......................(...@...8............................................text...D........................... ..`.rdata...(.......*..................@..@.data....4..........................@....pdata..8....P......................@..@.rsrc....2...p...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):175424
                                                                                                                                                                                                    Entropy (8bit):6.036513000632513
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:cQPidj5By4/EeaZL8Z0BFri9WSfWJVVqH9B+bCe5kNtupnu0D6EDpf34fdjdEcRh:heaCSgfuqdB+i48
                                                                                                                                                                                                    MD5:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    SHA1:184A42476F12A89731F608C7198E47BFC35A8364
                                                                                                                                                                                                    SHA-256:633B554A26AD05C06DFE33A50F6D69E9160207F3168E15FFD3CB5652B1E8E9D4
                                                                                                                                                                                                    SHA-512:DDB593D8A6BC515DCA7A4EADB2F50C28C8E61E9A829186BE9B9E8B19371E969FE055104DEFFD8CD5CD9B48F2468EC8B3D7BF6AEE45079E445D3FE42696E2D5A2
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\............................text...4;.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...0............T..............@..@.reloc.. ............J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateBroker.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):116032
                                                                                                                                                                                                    Entropy (8bit):6.62560704966013
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:oHsWPr3K6NL3FBqrx0LHu9eU53kB+XmkM/UTmG:usWG6l/q33kB+5M/BG
                                                                                                                                                                                                    MD5:612BFE378FBE209AC8584AE27640A97A
                                                                                                                                                                                                    SHA1:235AEA9A968A37CFCC8FD2C25C167EE3F8091607
                                                                                                                                                                                                    SHA-256:CA510F6779F14699708EA640175D8CEF89388D07BE2435D22775FC078C483E0D
                                                                                                                                                                                                    SHA-512:787A576E993E8D58F96EB2B0428B02AC318EABD249DCAFF26E87E6F01282CB407879D8BF280BC398D90D2EF822FDF4D11371BC732F12D8085C50DAF7F8D97407
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...2..e..........................................@.................................M.....@.................................T8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShell64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195392
                                                                                                                                                                                                    Entropy (8bit):6.420855633369088
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:INA1+FyhLMnQtMIHh1a/r8/kGgTWZi1vnoY46u8sOMRzy+jGre:OAowhLMnQtMIB1a/ospTbohL5y+yK
                                                                                                                                                                                                    MD5:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                                    SHA1:BC2E23A3FE66D39153CE5334F25FB218D9CE4FC0
                                                                                                                                                                                                    SHA-256:ABDD09D0B7A2718FDA3FED25F0C404F228BABD83AA59148AA40BD0E4E9A937D1
                                                                                                                                                                                                    SHA-512:07992FDB6B98940D403BE1AE6A7D49706EE198DF3A18771C330CB4703C4C9E83D519B23FE5CB4B1A117E7B70BBED7EB159F962AC1D7F942C8358F8DEA7F770BB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d..t7..t7..t7}.w6..t7}.q6..t7..p6..t7..w6..t7..q6..t7d.}6..t7}.p6..t7}.u6..t7..u7=.t7d.q6..t7d..7..t7d.v6..t7Rich..t7........PE..d...9..e.........."......r...X.......P.........@............................. ...........`..................................................{..x...............@.......@Q...........^..T....................`..(...p^..8............................................text....q.......r.................. ..`.rdata...............v..............@..@.data...@2...........p..............@....pdata..@...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateComRegisterShellArm64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):154432
                                                                                                                                                                                                    Entropy (8bit):6.173383322052518
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:VkKhe7NGODfqGfusU730roSnXvnaaDSNcp/:hhmNFDfXfusAxSDSNK
                                                                                                                                                                                                    MD5:F0DBBAC441C6232C55D5275C77A77DD4
                                                                                                                                                                                                    SHA1:6AA9207B5E119091948CF286A98138E1D9B0ACE8
                                                                                                                                                                                                    SHA-256:1B9A4836FD73243ED7B472D71344CFE103760413334D0E5B947C87832332CC2A
                                                                                                                                                                                                    SHA-512:9FA2CEDEC9AD950624B9782F6E47B322966605A6E412034471C0C8AE52CFBA894078F53671BB6F9B72C2D9584EA879A028EE37341A694443F1A517658B4DA4E7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|.8.8pV.8pV.8pV...U.:pV...S..pV.j.R.+pV.j.U.2pV.j.S.kpV..._..pV...R.#pV...W.!pV.8pW..qV...S.9pV.....9pV...T.9pV.Rich8pV.........PE..d...^..e.........."......2...........i.........@.............................p............`.................................................H...x....P.......@..........@Q...`..T... ...T.......................(.......8............P...............................text....0.......2.................. ..`.rdata..v....P.......6..............@..@.data...80..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..T....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateCore.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):224576
                                                                                                                                                                                                    Entropy (8bit):6.731913745591885
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:XvFYwxiy+jCOCx2FssbcF8RLcul9+2+xwEJAg0FuRxqD2YqMR5+oZmYex+n1+P1/:XNYwBOPfbcF8qVtAOOTR5z5ex+sN
                                                                                                                                                                                                    MD5:6E63E263EB7CB0A31F4800D274BD3936
                                                                                                                                                                                                    SHA1:89F0AF0FB5DE7288DB94A6B4DEFB9BB474216989
                                                                                                                                                                                                    SHA-256:9D8EBA8007E48AE1FFCC28129AB894814F844AB5C5D1543A3C8CF863C0F88A47
                                                                                                                                                                                                    SHA-512:55C74E7F32E6CE21670BBA7003EBB00AC7A121A3A11B535F98D1AC3D35D1893449CA078FD093FFFCFD7547F99DB167ACAFB427F0057ABAA9115382BB0315998E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bm...>...>...>^..?...>^..?*..>..?...>..?...>..?...>^..?...>^..?...>...>...>G..?...>G..>...>G..?...>Rich...>........................PE..L...T..e.....................`......v.............@..........................p............@.................................T............2..............@Q...P......@...T...............................@............................................text............................... ..`.rdata..............................@..@.data...l&..........................@....rsrc....2.......4..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateOnDemand.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):116032
                                                                                                                                                                                                    Entropy (8bit):6.626583684028364
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:yPMWPuHKCqLXFBqrG033M+tZnkB+XmaLNrfei:MMWtCYfqVnkB+PLNh
                                                                                                                                                                                                    MD5:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                                    SHA1:4E2302B2008CD8CCA7DAECBB13D42931971890E2
                                                                                                                                                                                                    SHA-256:79BAB0D36F4682194C20694F67F1B716438E7EAFBDBB83D9681259A41276D857
                                                                                                                                                                                                    SHA-512:55A671BF0BAA2407D14872AA3ECAA485D2FC267AA57374A1E0871B5060372F8989FFF8444B65BF256A45D9B92568F9B69F759F8B1E5DACE94EE91FB0A7774F03
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...4..e..........................................@.................................,k....@.................................\8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateSetup.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1446992
                                                                                                                                                                                                    Entropy (8bit):7.913845028849878
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:w2hOU0p4qlWfBTfmRfanIT6lUScOWFohEp6Vvn6qtndPVmatCkbpmp:zhOJpP4JTm5T6lkFohDB6sndPVa6g
                                                                                                                                                                                                    MD5:E3E7498C2436A1570109FBE755AF1D40
                                                                                                                                                                                                    SHA1:D7FB79F465D2C87EF22088327B5BFB73899FDF7E
                                                                                                                                                                                                    SHA-256:498E27ED4E5BB584672992F459C0E51CD1E7345889DFF1521CCF577B13ED6313
                                                                                                                                                                                                    SHA-512:4DD6025D4EBD1D4EDEEC077EE39E8704D2ED04FFD5F7AD83934A2ADA8D0E3AEFB15841B36AD0454E0C2CD6BE12E13B2015DE322D27059CB2FEA8BB7F4A247096
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........................Z.....................................................................~.............Rich....................PE..L...!..e.............................i............@..................................\....@..........................................P..<g..............Pt..............T...........................8...@............................................text... ........................... ..`.rdata..B...........................@..@.data...T....0......................@....rsrc...<g...P...h..."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdateSetup.exe:Zone.Identifier

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):26
                                                                                                                                                                                                    Entropy (8bit):3.95006375643621
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdate.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1116480
                                                                                                                                                                                                    Entropy (8bit):6.768405587681001
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:JYCOm/qiJZz4j02iDtjNDhSRXaD5O5sHG4reqc8fvT2bz9cjclU:NO8Z0jniDtjNE6Y4rNvTkz9cjclU
                                                                                                                                                                                                    MD5:36C7B693D057C28F237E57964DC3D785
                                                                                                                                                                                                    SHA1:468394D765AC4EA8A92C4B673D4A10C6DAA1CDBE
                                                                                                                                                                                                    SHA-256:A718ECF01E9E995A189A6A0F9F6367ECAFECEB7BDA16705E8B7037AB844E51C5
                                                                                                                                                                                                    SHA-512:6F3220C27BF9D44BCBA0AB1457543D29E1DD8381541624B81045D868813D5EE647035B42761A9F53D25DBFB5D00F598254E1BAF51816052929E637ED793C8E45
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......r.Y.6.7.6.7.6.7...1.7.7...0.7.7...4.'.7...2...7....4.7.d.3.'.7.d.4.!.7.d.2.y.7...3.,.7...6...7.6.6.W.7...>...7...7.7.7....7.7.6.....7...5.7.7.Rich6.7.........PE..L......e...........!.....R..........}........p............................... ...........@.............................T...4...........................@Q.............T...............................@............p...............................text...qQ.......R.................. ..`.rdata..4....p.......V..............@..@.data....X...P...4...(..............@....rsrc................\..............@..@.reloc..............&..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_am.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.575420072105715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:AR+H4k4+J2HNyb8E9VF6IYinAM+oP90at2rIYiF9qmPd9AM+o/8E9VF0NyKz7P:jHZJOEpYinAMxBYiLPzAMxkEkn
                                                                                                                                                                                                    MD5:550A1B340AB88809669FD17EC434561A
                                                                                                                                                                                                    SHA1:0F6C12C069746DB4AC01DA97185E090FF509C546
                                                                                                                                                                                                    SHA-256:3C113F4FF22B63D42E4B3351EA2952DBB1842655DD52F0F84951961CA7C303E7
                                                                                                                                                                                                    SHA-512:5AD6E4B96196B15FFCFBD189AEF474DDDDBE5E6AC3FBC49BE7EA9C99A39D8F8C38FDBF7C6D0FE20B1FF0048A2E8E0BB94631FE718C507301837B9347B3A3257E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...7..e...........!.........z............... .......................................H....@.............................D....0..(....@.. q..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ar.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52544
                                                                                                                                                                                                    Entropy (8bit):5.5725435735274305
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:J0ovtkCLu+JG8Nyb8E9VF6IYinAM+oP9VtdzACyIYiF99OAM+o/8E9VF0Nydh:PvtkCLdrEpYinAMxAEYi0AMxkE9
                                                                                                                                                                                                    MD5:BBC6198B60210C1578CBAA60B96FDC70
                                                                                                                                                                                                    SHA1:3A19EFD437D2C35CB15F2AB2D813466E8B1066B7
                                                                                                                                                                                                    SHA-256:9196D431048A4481911054ACAD58D849D9AC38715A2F164FB09CC52F5E41D105
                                                                                                                                                                                                    SHA-512:D89A7F66BF6273A0A232D543FDB98CF583B0DCDE2FFF058AA018A2368D0F0918CDCB317D0729749F490D5F6A5D9D36B04F73CB8E2CC3E3D69A123808B787B0A9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!.........v............... ............................................@.............................D....0..(....@..xm...........|..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xm...@...n..................@..@.reloc..$............z..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bg.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.5655586584292065
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Jq/odckbeGZBOcl8Nyb8E9VF6IYinAM+oP9ax7AIFEIYiF93jjMAM+o/8E9VF0Nm:yoV7DlcEpYinAMxyL1YirjMAMxkE0u
                                                                                                                                                                                                    MD5:DA09EAA0D93375AFE0709C1809C14939
                                                                                                                                                                                                    SHA1:9FD4700E02BFBB7E4C890CDD59F0620FB0F9FE17
                                                                                                                                                                                                    SHA-256:0BD086FFED7296FF1FD8228AED8F80B8D9A8E2402AB974A9258A86887347E502
                                                                                                                                                                                                    SHA-512:392C0DEE8ED74DC12978E29F5777BF5D3E93BB0F839C156951F34EAA9A72AC9F4E132A99344D9EACCD5D98AB12CC7EA5F95DC1D503B6C6CB1F4086380AAC3A96
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... ............................................@.............................D....0..(....@..8y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_bn.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.623684706857659
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:JcKhvUx7tYF7qKF0FrHF6zjbmBwgNyb8E9VF6IYinAM+oP9ndzZIYiF9wQAM+o/i:xhrlF0FrF3BwYEpYinAMxaYi1AMxkEI7
                                                                                                                                                                                                    MD5:28C55146F4311953E1CF7E468C8DC74B
                                                                                                                                                                                                    SHA1:76442CD814BE3FB21A0E2E8608E564C785548F13
                                                                                                                                                                                                    SHA-256:32216C7119BE97564830F8CBF4888632E7D1AC5F99AB65DA6C2E6A28D511800E
                                                                                                                                                                                                    SHA-512:5E13C7820218C29F26C64C12C318E40C11759B37300793F22E08F3D828361CCB1244123610B4AFE3E9E9E454263A862D136A96E4271B51378C50E8D2F8A83D47
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... .......................................{....@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ca.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.39160458880719
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Sv2ArBupGEEpYinAMxVYiDWdSAMxkESKM:Sf397HxV7DWGxuKM
                                                                                                                                                                                                    MD5:44ADDEF5DF612EF84086876FFA323A76
                                                                                                                                                                                                    SHA1:CC7639439B15CAF8FC8F9240BEF8B757BB3054A2
                                                                                                                                                                                                    SHA-256:108525B759F60C5076BACA70474640E1E262BF77FF3F1A1E7822198416084D55
                                                                                                                                                                                                    SHA-512:7211E8549A4D6A3BD6C425DA1065F8AE0DAEE1C7325D63A8E8535FAD7464A2043CCB5F379310AB4A22C4498728F3317B79F260C097CCC652817FB521D317106F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!......................... ............................................@.............................D....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_cs.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.442186434885563
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:OUBDBWpaJkhYwA+fwNyb8E9VF6IYinAM+oP9gpY83AIYiF97XAM+o/8E9VF0NyFx:huIEpYinAMxZsYiDAMxkEpb/
                                                                                                                                                                                                    MD5:68BF6960F7C5BF7AE817EFFC7632C017
                                                                                                                                                                                                    SHA1:F828B622D95F69222B68BBA9FA9F400672C84569
                                                                                                                                                                                                    SHA-256:5314C94178A6861A88792F34D924A56B5CC7214CC4351AFCBED536D5C3F13417
                                                                                                                                                                                                    SHA-512:71C84ED4417ED943EF752CDAC0D9E57FCAFAD80B3B16A2EE515734BF3A12F335FB9E4B0BE86DB1B607CF4E951D4306626C15C166C11579BBD0B866756D0DE53A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..0u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_da.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.409036773195985
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:O7aUfNnwtpTqPqNyb8E9VF6IYinAM+oP9G5rJXEuIYiF9YabOAM+o/8E9VF0NymB:X8nw/+qEpYinAMxgUjYinaAMxkEm
                                                                                                                                                                                                    MD5:6ECB0249DA48684622FE633F98F8F530
                                                                                                                                                                                                    SHA1:1B9990DCCCD813FAC7C5517A03E5C147816E486F
                                                                                                                                                                                                    SHA-256:0A52E3DC70183D8041683817CC0514004898E87D9C080FB93374E900660BBC0E
                                                                                                                                                                                                    SHA-512:E48932205ED3362B4C915C572FCAAD012205837F54520F66C33B12F9AB4179E03AEB559C18465E3C419242CF039DA5C0271FD2CBC0031F1E7C7594C71CCB75BB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_de.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56640
                                                                                                                                                                                                    Entropy (8bit):5.377480288938011
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:XKjmxUM8QtPM0Me6INK/AGNyb8E9VF6IYinAM+oP96jjjIYiF99hJIAM+o/8E9VF:UmXjMePsAOEpYinAMxaMYivuAMxkEhJt
                                                                                                                                                                                                    MD5:BAEA28AE8DD3E3C70DEBCDF1AE5448B4
                                                                                                                                                                                                    SHA1:F8F40C17ACE4FBF272618063BC35F2502B00ADC6
                                                                                                                                                                                                    SHA-256:4C2DA183A792B13077B398085CFF930CBF493B8CBEC50609F2BC6747F0B8092A
                                                                                                                                                                                                    SHA-512:04DE4F7FA8C4A625724337539EFF093E2371ED417A6363833E7F65CBD14C9A0F64BB17EF1BA4BF51A16D6611E8240E4D2B248E4622BAB462DC331459DF64C851
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_el.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.627688222986176
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:8Zr5lLO+R52/g4EpYinAMxSKYidzAMxkEd:2rl7207Hxt7dzxJ
                                                                                                                                                                                                    MD5:5FBDD326F7F291BE11E1D79A7B2C8A51
                                                                                                                                                                                                    SHA1:5701E5D3496F6D2F0C694D317F568A63990C311F
                                                                                                                                                                                                    SHA-256:1CB97FF90568D81F8CC9E6A2EAFB07EAA276834169365980279403D99756103B
                                                                                                                                                                                                    SHA-512:01BC099E7C875D6A0473F6FF577F14F3DA3123951596B5651BC757B6A2C10F293078452BB42A87084C3B862D4A0CD56129670234D2E9518E76379C534B534AAB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en-GB.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.419932966591344
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Xy1/Nagyh6QuZNyb8E9VF6IYinAM+oP9p91J3ZIYiF9fAKAM+o/8E9VF0NyUNk:uNagyhi9EpYinAMxVGYiQKAMxkEYk
                                                                                                                                                                                                    MD5:4396E672BC6FB86EDB0C6889D12CE082
                                                                                                                                                                                                    SHA1:C92279D00DBC2DC0EA13E3A8896EDA76A359723D
                                                                                                                                                                                                    SHA-256:F35E94567279C322EC1D4BB99EAA1327FCAA1F06F4BD9D1CEF8C897FD8BDA8C3
                                                                                                                                                                                                    SHA-512:45F40EACE1C0398EBCA42EFF48DE6208BC87147837459AEE6D882CD017A9069CAD2EBEFE8B1EF0D27F36981DDD963416F0B7B5A26AF98A84B6CB64666638D0D3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!.........z............... ............................................@.............................G....0..(....@...q..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_en.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.398655575356968
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:8VgzagyWk9RUNyb8E9VF6IYinAM+oP9BCDvCIYiF9L3qc2AM+o/8E9VF0NyQr:NzagyW4UEpYinAMxmYiOBAMxkE2
                                                                                                                                                                                                    MD5:364F97EE7B79DEB51DCC8F5EC4A0EE7C
                                                                                                                                                                                                    SHA1:EC4CACCAA57714FA8B9869315B6B13C530587E2D
                                                                                                                                                                                                    SHA-256:DE1E4766E0A2C188604AB2927025E1F5B05CEBF7E7B20E8342B4206686A7EB96
                                                                                                                                                                                                    SHA-512:43894949B412A8ECA8032F68DAC6C9208D9297B8C0353B9BBACEFE13343BB94343569F4CBEE1AC2B90971C8E2CC81408C55FC57DFEB94A6297D28CBB43E4D1E6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_es-419.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.391103646647603
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:8Uil+fs4INyb8E9VF6IYinAM+oP94Y6uFkJIYiF9EW4EVdAM+o/8E9VF0NybJ9:Il+fs4gEpYinAMxnZYiWELAMxkED9
                                                                                                                                                                                                    MD5:C2E2C6690755507979F570CA3E92E903
                                                                                                                                                                                                    SHA1:F82052FC3D2C97C18CCAE91CB64C91F02DC09AC5
                                                                                                                                                                                                    SHA-256:FD60F26D62F58D1AA41D11A8AD3086E2A0D92EF22AC766F606AEB2BCC3B217EB
                                                                                                                                                                                                    SHA-512:319A6418576BE4274269F533A5CEF62F9020B606494F3C7A5B299957931B919A86507F7888EAB5C6BB952BC65DAF76AE89439E72778BF97F77B30B520E904148
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................H....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...8........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_es.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56640
                                                                                                                                                                                                    Entropy (8bit):5.365606356097874
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:86qBkNzf1FNyb8E9VF6IYinAM+oP9FVIrIlppcIYiF9kSx6AM+o/8E9VF0Nyueu:KBkNj1BEpYinAMxI2Yi1oAMxkEq
                                                                                                                                                                                                    MD5:91C76FBA7736D06307708EE572CB9ED4
                                                                                                                                                                                                    SHA1:64764FCB44F18104E7554D8091BD0C7EDAA9D1A9
                                                                                                                                                                                                    SHA-256:D62078627149F4B5B90EE68B56C640CE120519F2F0438FC136AF225510CBD343
                                                                                                                                                                                                    SHA-512:F789D42681BDCEE52CFD342F019A16396DAE0E3F8C929A1A004E1F9F960EC94BE72B40E8D22A0DFEDA1F743564568F457EA64A6C6E5074F323C4655964402097
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_et.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.407227689072818
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:VYBW7bDFbDZETJ9TSQMNyb8E9VF6IYinAM+oP9I6UwqLYcIYiF9sx5q7AM+o/8Eg:Sm96nHMEpYinAMxTYiOYAMxkEg
                                                                                                                                                                                                    MD5:9599F4AEE019804B418245C5A86881C7
                                                                                                                                                                                                    SHA1:517D4DDD90361B89359BCCC174D9A6ECDA391426
                                                                                                                                                                                                    SHA-256:3023BFEDCD84AC065A38C4C6C983CCFAA0B3D5C02A610C6CA2EA00FD5545DABB
                                                                                                                                                                                                    SHA-512:613C6F11D11D84C1208B1CD7BDF030C3D2F5B90BC4D134C6E0584121B688AD14B01CE38C56501898962F5C859A8AF54248E86F510C20F3F7E0415163FFF95F14
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........|............... ............................................@.............................D....0..(....@..xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fa.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.562768970202109
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:VCYQOZMK9Y5fNyb8E9VF6IYinAM+oP9eLcfiPdwFIYiF9EbrJAM+o/8E9VF0NyXe:c1VBjEpYinAMxMcqPVYicxAMxkEg
                                                                                                                                                                                                    MD5:A09A6C8DC7CEFC6CB126939947884678
                                                                                                                                                                                                    SHA1:16F90FF84A3CD8C98304459007C7D05A98D05CC0
                                                                                                                                                                                                    SHA-256:C5CFADFE624A0B92B45B121DC30D06D89150BDB03FD45B4FB7B4534BBC7EB40E
                                                                                                                                                                                                    SHA-512:AF6F3BE99AEA54D26E933C98695644596D814E4E8B880E5CE081093A474FB8DF973853DE5220E498ADC84FF752CFD1CA4165771F04048CA9ED7CB6C179050798
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........z............... ......................................q.....@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fi.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.408662294317196
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:V1HzPEzPhXY7RzYd99hKh1GAsNyb8E9VF6IYinAM+oP9BSzehCaIYiF9ca8lAM+c:PzPEVmKgsEpYinAMxqzTYin8lAMxkEsI
                                                                                                                                                                                                    MD5:1DFC8B3110BA27F76C5C6495533AF538
                                                                                                                                                                                                    SHA1:DD60677F7AED0FBC06877333136562EDAF0BAECA
                                                                                                                                                                                                    SHA-256:60A159777971A84302E150866CAE1339ADC04939BF12B7B2367243361499BBF9
                                                                                                                                                                                                    SHA-512:37674C26A179B839239337219EAF8F78AEAC10425DE5E7CC5A91B140B816410EEC5C4DE84E7BE825BA4CED3AA41F1B421B1902D26C5A9384C725C5682017ED72
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........~............... .......................................G....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fil.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.386310916321289
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:D7U9w+B3RVawWrEpYinAMxmR7zYiyOAMxkE8e7:D6w+B3RVawf7HxMf7y8xN
                                                                                                                                                                                                    MD5:20152624A1FF01D9F2BAC28D7B00CCA9
                                                                                                                                                                                                    SHA1:A320967BEE24E07725E3AC2DC2F66F264F1B9221
                                                                                                                                                                                                    SHA-256:80063F2CA78C9C757FB06B36F24F0347992DD75D300C4FB4A0DAA90D31B83A2D
                                                                                                                                                                                                    SHA-512:A9334CC7D97A212F816EEAC0EBE8D6A5CC4B83C72DC10C34682AE504EA9690C077A84246DBA1462E991C609431CC93B085ADC14DAE28D468B537305161D56EF7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!......................... ......................................-.....@.............................E....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...5........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_fr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.3857985161200785
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:qqov98EoycpW4xUNyb8E9VF6IYinAM+oP9HaOp/IYiF91ihkAM+o/8E9VF0Ny3j+:OvaycNUEpYinAMxoMAYiAhkAMxkEt+
                                                                                                                                                                                                    MD5:7704C15C3F3F312CAF2849DC2EAB0E78
                                                                                                                                                                                                    SHA1:E3C673D407464CCB1E2DF5FC357D814C61213F7B
                                                                                                                                                                                                    SHA-256:FE634E2F6C7AD7BAD17BD0A956B612BB14A9064B98CF5B5E013E08AC19204744
                                                                                                                                                                                                    SHA-512:704A7541B55962E0DB1BF9388DA3F8A2AE1AE284AA60409D5FBC30F9BE275658D10C2DBFA80DED9F12632DA0F4F076925B5658B4F16EEEDD5320AFEADDEDCE85
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_gu.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.61051850410968
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:q6qm3UbeAV4DnYCRfwmkIPNyb8E9VF6IYinAM+oP9iCpiA4RpIQnBIYiF9jdiAM+:EUUbe7hbzEpYinAMx07nWYi0AMxkEoem
                                                                                                                                                                                                    MD5:41B7CEF8A631E5F9FF1B54F6B0CE13E7
                                                                                                                                                                                                    SHA1:8B695116808D99DE0B49EB54FF8AFA9A6E81368B
                                                                                                                                                                                                    SHA-256:3B5FFC2C6DCE2BE431CF686FCD2D2CD39FF003D42AFC27887CB128B34CBEE354
                                                                                                                                                                                                    SHA-512:15E72B1B3FDEB5A7AC2C4AB044224D25521A820AE62C725ECCAF6E3E2C1CDB24F9EAFB3AA12E1C1ADB042E762D49E0FE6A3B81280D1E5346BCDBDFFB8712B6FB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ......................................1.....@.............................D....0..(....@..hz..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hz...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hi.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.584260993420684
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:j4x6AN6AQqjexbyqKXhHqC1EpYinAMxlcYiXl2AMxkEb:j4xXc7Hxlc7VExH
                                                                                                                                                                                                    MD5:5EAF10368F71EF58845D728B1C35DEDA
                                                                                                                                                                                                    SHA1:1D525E25F5B1B2546285B0BCD18BE0D2F81F17A5
                                                                                                                                                                                                    SHA-256:E9FBEA12B32D02160D14370501A622C032114C592EF7C5BF94EB620283FCB6D7
                                                                                                                                                                                                    SHA-512:94B31603651BC5A3BB51E44E07AF1BBDB4B6D9EAF5B0AE7584525155224F23F653AFEA2DDA885620C6362D8CEE6189C5B6C86C2D76E2CDB541415A604A4B1FE3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!.........~............... ......................................#P....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.402610840778619
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:TsfBpdOXz19szMH5KBL/yNyb8E9VF6IYinAM+oP9I2ZlxEIYiF9GTJAM+o/8E9Vz:GBK5oL/SEpYinAMxPYiSJAMxkEn
                                                                                                                                                                                                    MD5:615FEEC50393BF657E7B84A864D534A7
                                                                                                                                                                                                    SHA1:0D3807C4E28D0121C43B3A910BD4538DEEC70B5E
                                                                                                                                                                                                    SHA-256:6EB847167FF384D1D30B6D16939980DC89D95547A18CBA91136CE66CEF6C06B7
                                                                                                                                                                                                    SHA-512:76FEF42FD098DAEAC39B495C5AF7E71784204936D4D75483BB49678C3995C7FE0FC3B75F5D2E034FB974AFCFE45FA4158801C92F0A55441C5E8CD34647142AFA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................T.....@.............................D....0..(....@..@v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_hu.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.425116799449756
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:Q17U791C2TzpwGFTbZY6d1lBVZ5qAy3FGd7HxQ74xXa:Q17U791C2TzpwGFTbZpd1lBVZMAy3FG2
                                                                                                                                                                                                    MD5:E200F70987E56CBDFF8C6A587A02705F
                                                                                                                                                                                                    SHA1:8C135AD82792C337445DAB4677B654C7390BF36F
                                                                                                                                                                                                    SHA-256:B285107D2D2F2D64F2F060CF57E29B08C5DD9498CE8CEF83ED7C30032CE4625F
                                                                                                                                                                                                    SHA-512:81163C216A1D4FB7B328D4982F4A251601242320EB413B88F423CB133526484667328716D368DAC110E6E2E4715814A8A1A85BF56A81C42DC8E48049DECDC767
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................_.....@.............................D....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_id.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.402370571282084
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:TxFmhL3THRNkAHqQ3lFRf2I9ByrUvNyb8E9VF6IYinAM+oP9Lfu7byIkdIYiF9X0:WXhR5TEpYinAMx8oKYitAMxkEc5
                                                                                                                                                                                                    MD5:16C771FF09E9BCFE7FD617C0F5D489AA
                                                                                                                                                                                                    SHA1:55AC69B62DD357DE4884A95F95786AF979F2CFE2
                                                                                                                                                                                                    SHA-256:6F747BB6BCF0491A3B7F2F04B802C41BD895A01D94F11E7E5B6721B17DEE26F7
                                                                                                                                                                                                    SHA-512:D85B041F62241EC6F4685372895200FECCC1F277F1E0D4A5015AD79CEA12FD19BB4B864EF871A4F6D7B4C0D887F4F92FAB74BFDFA7940B07866B063464749C4F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!.........|............... ......................................z2....@.............................D....0..(....@..Xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_is.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.42997837750232
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:gJqibAIErkUVQF5UefV3BEpYinAMxxYiPAMxkEA:gJqibAIErkUVurfVa7Hxx7Px0
                                                                                                                                                                                                    MD5:1844776B1E873892CB6D453EBCA334A2
                                                                                                                                                                                                    SHA1:6F36F4BF2CE6D286C0E1E59041EE506BBB96ED7D
                                                                                                                                                                                                    SHA-256:98E823748DC2E72B8B5A46827D501E12C9C48E209643F2DD6B4B8D333501DF8E
                                                                                                                                                                                                    SHA-512:8C48EB7CC40EF6798C9789A9B860BCF508D3740E948FE64E1197A422CFD240A6430FC36B5AFC23A5C1CA73FB155003B22A57AECEB207741BC9EBCAA947A411B6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_it.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.3695383590059125
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:4SIlDIN+shh3+Nyb8E9VF6IYinAM+oP9BNgIYiF9zMAM+o/8E9VF0NytlR:UVIN+q3GEpYinAMxPYiIAMxkEP
                                                                                                                                                                                                    MD5:E7A5254E3C732ED21F756B90EE6C73B3
                                                                                                                                                                                                    SHA1:EE2C5D342E51BE27750F5C855A9437B6BF3FEB86
                                                                                                                                                                                                    SHA-256:9342ACA1761B4F81F8771F19CB4A1ABD77F392194D32758FF42B98F8AA3D6CB5
                                                                                                                                                                                                    SHA-512:75F83A5905F8254E4FB352D00B8173D2A5614C17D166C06AB87C0B67C1C7BDF99377C7BBB89A85E6AFC5F0E5F8A045E45D64B2B157A413E871C015EB65D46F3A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!......................... .......................................a....@.............................D....0..(....@..@z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_iw.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52032
                                                                                                                                                                                                    Entropy (8bit):5.602368818487498
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:4cKIv7hdVexaDywGfJssDNyb8E9VF6IYinAM+oP928tt+fIYiF954AM+o/8E9VFt:EgNM1fEpYinAMxZRYieAMxkED
                                                                                                                                                                                                    MD5:0DC19E59ACEDB7D103D0C21B02804661
                                                                                                                                                                                                    SHA1:477FEAD06B9DDFB85185DA85A640E6BB467FC32A
                                                                                                                                                                                                    SHA-256:17ED8A04CC1BCAB734F23140BFC8145BD0D038C284D50F439DAD1E66F7647C22
                                                                                                                                                                                                    SHA-512:20F3E9B58E9D5AE3F08096ABD5D5A43DB93238FDCDF2E96126A4B4AEB06BE2C8ADDDDC6601136EA265770AFCC7F4BE41E20F1D28CA361FE0135FC98BFA71F392
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........t............... ......................................nn....@.............................D....0..(....@..@k...........z..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@k...@...l..................@..@.reloc..$............x..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ja.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51008
                                                                                                                                                                                                    Entropy (8bit):5.615534777551888
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:hz7iEHj0FgWGNyb8E9VF6IYinAM+oP9EimJIYiF9mRDxAM+o/8E9VF0NyzCU7rR:RiED0FgWOEpYinAMxHYiWDxAMxkElt
                                                                                                                                                                                                    MD5:6C6093A914A889BC15133A57DB09C395
                                                                                                                                                                                                    SHA1:A8F9D54288D636E586271D78E7CF69E9E0121E16
                                                                                                                                                                                                    SHA-256:EC7AF1E9B03241F85A99F9C807FE279E322CA5528DD08B33F65D0CEFB8F04EED
                                                                                                                                                                                                    SHA-512:3548503A8395ABD3D19D3FFEF24832242F6F6C742678C0657FBF795DD14584B9F35BE5B02D7BC6657D486E63609E0687C1E277857DBEFCE6AE7D97E6E135605F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........p............... ............................................@.............................D....0..(....@..@f...........v..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@f...@...h..................@..@.reloc..$............t..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_kn.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.638575498464374
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:hgLfUIRBSWNyb8E9VF6IYinAM+oP9BGv0Xs8fIYiF9ngp+AM+o/8E9VF0NyNwZ:cfU8k+EpYinAMxq8TgYiop+AMxkEo
                                                                                                                                                                                                    MD5:12B9BE5F0923BB2313C68BB46A069F4F
                                                                                                                                                                                                    SHA1:150A975918C1435027F295A06058C5BC110B4AB0
                                                                                                                                                                                                    SHA-256:DCBA408E4AFDC0831CB26D08EC05EA0616F14071E81ABAC8FE5676636C2EE151
                                                                                                                                                                                                    SHA-512:1CFC30E83851456DD3A5925925E34AC12F7148E20F487CDB82E0F01E06DD77B6411CF03B2094C11DF9566B1228A97024065A78F77100493902BBBEFDF6502D27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!......................... ......................................n.....@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ko.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):50496
                                                                                                                                                                                                    Entropy (8bit):5.652443774196828
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:hUELKTd4IY+N1vZsYoRHgA12plxB4xRkkTY1M5tkOANyb8E9VF6IYinAM+oP9cbA:HLKWmAf/jv4EpYinAMxhOHYiSAMxkEp
                                                                                                                                                                                                    MD5:10BAD5A24446C6E00AD2C18D09B000E0
                                                                                                                                                                                                    SHA1:FA030AA1F64894829C0CD8211488B38A18D12297
                                                                                                                                                                                                    SHA-256:91649E91509AA7200BB669AD2F5F6788EBAD7C5AA2CA6D7BB855E9FD96D010AE
                                                                                                                                                                                                    SHA-512:6AA1E426BF7AA470058810F0515A94C1F6D624B4FF3D99BBA09C850FD17DA4A2C2C50BDEF44AA28BBB3358486844520C46482FD7295B9EE50CCC8449940016F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........n............... ......................................P3....@.............................D....0..(....@...d...........t..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....d...@...f..................@..@.reloc..$............r..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lt.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.426785047163885
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:X1ckHz05TmDq09ZEpYinAMx7b+YivPAMxkEkt:X1ckHz05+i7HxG7Hxwt
                                                                                                                                                                                                    MD5:74838014C6FDA1D53C8EDC8679F9D28D
                                                                                                                                                                                                    SHA1:491C640873E70CD0C703C57DB6F0FDC941CBE7F6
                                                                                                                                                                                                    SHA-256:6AAC9D75D6D02884C5CB5EF33A4BD1801D9BE70DD937C624F21E492F64CADF68
                                                                                                                                                                                                    SHA-512:ED792A4B625D889D8D17AD1DD23D0CC015F28B3DBCA5CD6C525E8C814996B1F806855AC4B9D59758306BE5F6F0C09979D1ACD64332E24F4C3358C5FD6857A22B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_lv.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.43355377301059
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GQQpZyAxOeK6eDNyb8E9VF6IYinAM+oP9l4ZCIYiF941WAM+o/8E9VF0NylkC:IdufEpYinAMxWYiSWAMxkE0C
                                                                                                                                                                                                    MD5:8FA152CA88C3108EFE077F57482BB42A
                                                                                                                                                                                                    SHA1:B27058398730B18E39D9E16FBFBC5625AF403FF8
                                                                                                                                                                                                    SHA-256:01C42EB00F2E6566D3FFF4AFB0B2C2FAF34C14A1A61E29DB86B3CB76D4EFBFDC
                                                                                                                                                                                                    SHA-512:81620FD3D80A1C245BCBD643D1B579E3D413B3A0011AC65F39CE31929908FCD95C1D4C0D5BA89A1F907E02E351CE5EE2CE79B61E7176CA9706908BCE7A4BF59F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................n.....@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ml.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):57664
                                                                                                                                                                                                    Entropy (8bit):5.590444403006137
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:G3zU3B7FZygp8/JLONyb8E9VF6IYinAM+oP9OFIj5iIYiF9ImPAM+o/8E9VF0Nyv:JRWJL2EpYinAMxpYifPAMxkEeC
                                                                                                                                                                                                    MD5:F693B959CF8C7341020D18ED345AD74B
                                                                                                                                                                                                    SHA1:FD57E1806796F23C639531E6DCC165FCEF4F37BA
                                                                                                                                                                                                    SHA-256:0B37B36D43D032BFB68F06173107AB58E8C17904C3D1247C32690E168FA922F2
                                                                                                                                                                                                    SHA-512:E474312498C874EF53A1FCC75A9D28A35341577BDBF672FB3D82D76A2BD9BFF6BE9477A61C64D1EB434FCB9FAC7B65912E033FDEF8877A681C614A035C01E347
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................c<....@.............................D....0..(....@..x...............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x....@......................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_mr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.588716592426551
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GfvCdo/7JK7bABkCNyb8E9VF6IYinAM+oP9644k0VwIYiF9QqoAM+o/8E9VF0NyZ:uYo/7JK7b5CEpYinAMxmvYivoAMxkEBV
                                                                                                                                                                                                    MD5:0DC5183697F790CF937860F9F8CCF8BE
                                                                                                                                                                                                    SHA1:531C04F6AA3B363A14740CC33D1E4D98BF857BC7
                                                                                                                                                                                                    SHA-256:8176DA09CFF7F0BAE0AA08430CC4CA093A68627FB631A377DF0EC82959E7F634
                                                                                                                                                                                                    SHA-512:E58A71558240BEE892FB783E061BF481CC2F56F01BFA5F7A2C50C0EC69B2360AB9564E80C3D34ADE0296DB1D9509861484A3D6AB3936880AF9D23CE13FF1A373
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ............................................@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ms.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.4114238474999805
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Pr10IePeyrQLtUv6oNpaMkYjZZ/fbMgTRlREDNyb8E9VF6IYinAM+oP9LeFFjUIX:qjTZf3TFGEpYinAMx+jlYiFAMxkEj
                                                                                                                                                                                                    MD5:742CD3150B436B909E5AD9AB6F22783C
                                                                                                                                                                                                    SHA1:474B8B3B75CFB25C90EB33E8E4BBCCB07068DC8D
                                                                                                                                                                                                    SHA-256:E537F7AB167D50E347B359AB848C46405C7FFD067408E896858C31AA99E6B228
                                                                                                                                                                                                    SHA-512:CDD492F93BBE49F17DC8DBAA19C1FE1FB1B3403054703D20402B07A42BB5D5F5D20F1D126103AF0DCE62EA36299835902E7FAFF96EA5D7EACD59974E6F88A2F2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........|............... ......................................?_....@.............................D....0..(....@..Ps..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Ps...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_nl.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.380500350214481
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:P/kLXd/T3kXNyb8E9VF6IYinAM+oP9e8Kk6U92ZHIYiF9524AM+o/8E9VF0NyZwS:ULtgbEpYinAMxPSUTYiFAMxkE0S
                                                                                                                                                                                                    MD5:A54633E30C2FFD23C3578C885E0E9F5F
                                                                                                                                                                                                    SHA1:662988663B27C21A0CC310D304346466EADD76A8
                                                                                                                                                                                                    SHA-256:3FB8523B91B2BFEE51CA2EA972ADA260F27BA389EA9E1DD7CB8411F21F126CA2
                                                                                                                                                                                                    SHA-512:AF9213815F634BC3A1DAFDF0D2BE537E4634D690C118090A81DB1138130504B4EFD27D9D0599F7295B06A5BCCE44B71E200574E583C820E820CA84D72D6E492B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!......................... ......................................D.....@.............................D....0..(....@..hx..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hx...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_no.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.41113033461094
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:PZ75JZSiyCSiykeRAYiTvaK3Q3Nyb8E9VF6IYinAM+oP9P+6kIYiF9+60/AM+o/d:xeCYGiK3Q7EpYinAMxtYiWlAMxkEh
                                                                                                                                                                                                    MD5:A78998736B54EC264AD3FA9529693C8F
                                                                                                                                                                                                    SHA1:4B468CCCB8AC25C9E9C05161DD5C44E08504B41A
                                                                                                                                                                                                    SHA-256:EB3F06A4EA447CE64971673C50CCF83E2842303F1A27655F3A170495C94B71C6
                                                                                                                                                                                                    SHA-512:F747EC1B69B931D90EF4CF31A5F8E7BA95B6AEC7B36299A0E988B1D4790F42BE8AF698FE66032324C9634E5A44FD251D7BCBFEF9C5529E7D2368FFA38CEB5962
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........~............... ............................................@.............................D....0..(....@..(u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pl.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.433825393956769
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Uym9mn7KZHCCA7U8Gp6hNyb8E9VF6IYinAM+oP9LK5SIYiF9YjAM+o/8E9VF0Nyi:SUy3AIylEpYinAMx0YiCAMxkEU
                                                                                                                                                                                                    MD5:E73CF3871B41E0C59440C8D709CCFD75
                                                                                                                                                                                                    SHA1:8428813368197AEE8E3C2BF2104297476BC4608F
                                                                                                                                                                                                    SHA-256:AD124B0646894F3BFCB61D366D7BA5EDF4978766807B5422AD1778509231679F
                                                                                                                                                                                                    SHA-512:A31E82503BB3D8E1DB9EF4C1030ECD481396183CC64905FAF91E52F9C3E68469FDF3A850357AD70466D2810855D2B58E19B9302499D2547F85A610B1F8159FF5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pt-BR.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.4115414787256
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:UYnLplZcOZX8mNyb8E9VF6IYinAM+oP9m675zIYiF9cHymAM+o/8E9VF0NycBM8s:3bguEpYinAMxJiYiEAMxkEI7s
                                                                                                                                                                                                    MD5:0227D71A996FAB2B394DFB17A43F1F8D
                                                                                                                                                                                                    SHA1:DA6002C093911114035CBD5D7D29FA51E3DF2C45
                                                                                                                                                                                                    SHA-256:290A463B8B11E5F5C5D3BCC2B5B8D910721BA645E2B4B3AF951223F76610BEDF
                                                                                                                                                                                                    SHA-512:FB95F13C4AC6A7B8AD13F271EE3D93ABBD5E0713F0C0DE402D7B73EC82B483A26C6B071ED5521914E34E74AEF168F9FA0762801FB37EAD9D05CD3D675AE2CCFE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!.........~............... ......................................W.....@.............................G....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_pt-PT.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.392362813870133
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:UaAtOstnEx6ewB/Nyb8E9VF6IYinAM+oP9/KlAIYiF9J3ReAM+o/8E9VF0Ny1SX7:w/Ex/UDEpYinAMxGYiNgAMxkEC7
                                                                                                                                                                                                    MD5:962BFFC6EC3DA987471851A4240AEB61
                                                                                                                                                                                                    SHA1:BA1B8AFF4FACD861553039A256A7623ABF30CD66
                                                                                                                                                                                                    SHA-256:3BD318A0867F1C971DAAE6A96C6EF2A09FBFB15EC5B3706DA34453410EA1F4FA
                                                                                                                                                                                                    SHA-512:D975EE07C82CD658E4A3B6CF67BBD8FD41D989D718E5EAD479E0250BC3C66A933FD0E8B1DA468E0C906986AEE58E3C0F148E4F8A23B19121844F5847E1AE14D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ......................................K^....@.............................G....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ro.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.412695960496245
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:5nCRNNDM7qm0GdVqT541naEpEEpYinAMxmYiTAMxkE0:5VdVqlca67Hxm7Txo
                                                                                                                                                                                                    MD5:54B9FDA6AB88DC9EF0F0C8B19EA06CD0
                                                                                                                                                                                                    SHA1:C34D52741A8986FCF0991A4CECFE1B2A7C6E85AB
                                                                                                                                                                                                    SHA-256:1F00F564F1136096FBE58EFDB22E54923E090BA3392CDC51C837A7294A3FD5BE
                                                                                                                                                                                                    SHA-512:BEFDF3BAED01EA905751CCE248E854CDC43D5A9D77B2EBD27E68C297464A5A0AC1ADF739E8371F0C731A5A7ABB83E6FA227D11120F70D668113F69612D44B6E9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ru.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.578353591774595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:tlWSFA47AvHlho4d2hNyb8E9VF6IYinAM+oP9Hn737IYiF9iFAM+o/8E9VF0NyfL:qvvHUlEpYinAMxF0YisAMxkE+No
                                                                                                                                                                                                    MD5:DD650BDAB776FD3239AAD311BC8CBBD3
                                                                                                                                                                                                    SHA1:583A340581B2A78DF490951FFE6A7BEEBB51BA11
                                                                                                                                                                                                    SHA-256:475B114201EC72F4EF26FC66B61AF438CE77F69E5E96D3CFC8FB00BA148AAC51
                                                                                                                                                                                                    SHA-512:862313704DFFAD1AF1FA72D8F9F1FE4757A9A1082BE41C78E5C307C56F36D986D1F5580922800050E08BB37ED2EB18A6FF629131199E41350A22EA230DD6DC9F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sk.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.437717171626643
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:t4lmP8uhJPiR6gLTmNyb8E9VF6IYinAM+oP9AWB5BGJgVIYiF90xFNAM+o/8E9V2:uMF8RjuEpYinAMxlgqiYicFNAMxkEAR
                                                                                                                                                                                                    MD5:DC24DAA70A6551CD038929F3EC055306
                                                                                                                                                                                                    SHA1:99843D43C0CC3D4C76A5C817CA4DB49820820C65
                                                                                                                                                                                                    SHA-256:847440B8D60A11DCE3E254916E5CD926D58C9F06F0D95436B62FF9B9AAAEF4B0
                                                                                                                                                                                                    SHA-512:451C21F435A451CC4C47623D028B1CF3939CB59B9F9A6D6D71B2F94F9B4CFD487A8756ACFF27768B454F23F2D501E9AFC67E586F9C005142CBC712E5CEDC2D9C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........~............... ............................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sl.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.399846673022657
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:tkcnTcshVyigOHHTpWBdH1i2IXousrNyb8E9VF6IYinAM+oP9z5XKiS9IYiF9JJd:v+hOHHy1YZsnEpYinAMxfXvYinAMxkEP
                                                                                                                                                                                                    MD5:FA0AFF0B7EFD37A6195AA454012095E8
                                                                                                                                                                                                    SHA1:EF4A3CA1608A8FD5DE56B2B94DBD46304480B375
                                                                                                                                                                                                    SHA-256:7580B1B666C4A6DE0EB5AD03DAFB2F9FB49AD148754A68611E9988ACBBA5023D
                                                                                                                                                                                                    SHA-512:FB5A73B6134F991FC2E5D9A82B747C821074BEF86A7651638FC0127BEEF78B817811BB00417168BB937F968D55D8356AC0D19C2B569A6B9B31A10531683466CF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... .......................................v....@.............................D....0..(....@..0v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.573738261423414
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CT63FOxCx7UjYN3tGGNyb8E9VF6IYinAM+oP93kDWvSpIYiF94yIj/AM+o/8E9V1:D3TUj+dGOEpYinAMxoCYi8/AMxkEq34
                                                                                                                                                                                                    MD5:D5D54965E6FB81875F2FCEA8F21515BA
                                                                                                                                                                                                    SHA1:87F22E6FA6D34CAA26CAF427D5F339880496EFE1
                                                                                                                                                                                                    SHA-256:759CC7CC96EA181926AF2F6B274CDB9BF63E329FC32A7A1C10B4CFDEE786F2A6
                                                                                                                                                                                                    SHA-512:308068EB57F007A4674BF5D90C9410BACC715E4AE537ADEC4CAF7F6837544D5526C676BEB2B1488090E7D9F4E966F030709C2934DE3A64E0A9059CE49D1F6A14
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... .......................................x....@.............................D....0..(....@..Xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sv.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.415346681858155
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CeC7xC7Ec3EINyb8E9VF6IYinAM+oP9Up1XIYiF9+kAAM+o/8E9VF0Nyu7:E7xCYc3EgEpYinAMxqOYioAMxkEG
                                                                                                                                                                                                    MD5:9C09AE8A870215FF9CF80F09D44F5610
                                                                                                                                                                                                    SHA1:2EE0328D7617A3D5A46C432DB2AE8BA2D335CB10
                                                                                                                                                                                                    SHA-256:49FDD7A5FA81697613F0495EA9E6025FFF84565184A1F3279CA42B166920F1E8
                                                                                                                                                                                                    SHA-512:7351B3955F0F881329DCD209841C84A05E0A2C2472FBF1B9F70505D4CE4A6A5FD612D45F3E11E917AB4D086E3B0C1CC7429238EC6DB6DBC879ECD9F3B8340B1F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... ...........................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_sw.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.425300372554538
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CL9FgicgiY7upr4M5aNyb8E9VF6IYinAM+oP91k+DrpIYiF96sAM+o/8E9VF0NyU:QFQ07Gr4M56EpYinAMxwYiJAMxkEUh
                                                                                                                                                                                                    MD5:1048D12C5DAA3492E2CC9060BC6AD9C4
                                                                                                                                                                                                    SHA1:50051ED23E19D842EB6C9162F537E7C20185ADE3
                                                                                                                                                                                                    SHA-256:9123A236243EC5508DB14A4E4E5B2BF3DCA077A6F6A85D24730D0A60A7B10518
                                                                                                                                                                                                    SHA-512:F9F6FF586A13CB32281234478A9F7CE2C6222EB94029EBC448815A5083E0303FC7CCA26F03E38575D449E81869817425F9AB2FF321D6A7EA5EE2EB0F99FB6C7F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!......................... ......................................<V....@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ta.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56640
                                                                                                                                                                                                    Entropy (8bit):5.625808123733913
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:KmHY51ZLm+4HwpEpYinAMxRBYinyxAMxkEqw:K27Hxb7+xmw
                                                                                                                                                                                                    MD5:795ACCE152FDF555FC5F0CBDC21BAC4A
                                                                                                                                                                                                    SHA1:B3A5F664D53813E69E33B4AEC327D8121E6066D9
                                                                                                                                                                                                    SHA-256:F22F4C4B011B9989D73F0EF16D85F9AA5471CC03394C99FC6D74C401ECA88700
                                                                                                                                                                                                    SHA-512:92638A7BD5962C44F3B21864FFBA114EF82B66334735D247B53ECC3A980C1208F597260547A2B9DA938C6D9D9BEF37AE94D5F6AF0683E0D551E6285D7FAE5769
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...}..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....}...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_te.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.591538654163846
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:aVo3N5ya+LDQEpYinAMx7i+HCYi0GzCAMxkEX:aVo3Ip7HxI70LxD
                                                                                                                                                                                                    MD5:CB8793AEC04A19877FA3702EDA7C9416
                                                                                                                                                                                                    SHA1:7771A48AFE1B50C03BAE7D98090929753177C9DE
                                                                                                                                                                                                    SHA-256:FA58B434E5253B28091CE425EC9296E499241CFC24992E1592154FD1EC449819
                                                                                                                                                                                                    SHA-512:577EE217E15379E1523FA72FD995E450FE7DAD262E299B594CDC6A8455DCD5002454B84695BCB3B3370DFB03C0B540B931FFF2C43AC50311FB5E95CD9A76219F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_th.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.6119616279583715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:TjlrGszNMfetNgEpYinAMxwKYi6AMxkEyI:TjlrGs+fetn7Hx774xWI
                                                                                                                                                                                                    MD5:36FF03BB1A029CF62E2FBC0112AB1E1C
                                                                                                                                                                                                    SHA1:C6BF4C0E47941019999722F1E57346498AF0A79A
                                                                                                                                                                                                    SHA-256:0F6B55613060D527AE41D5BCF5F34F50BD668BA57F9D4D2521EE7DAB2D053C02
                                                                                                                                                                                                    SHA-512:08AF745E330ABD384BF06468A2C1A7F6221B0A6C1A9452031FCB4076959C51EB912269EFF77E71F55BFB41C2BE1967A9373B224522ADF856E07B48593E68A92E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!.........z............... ............................................@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_tr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.448739449189127
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Jip9ABk6qXQEdmvgh3FGk+G9Ahrx++BzQSX/EpYinAMxlDCYiZ+mAMxkEPo:JiZhdmvMFGkSxLQK47Hxg7Zxx0
                                                                                                                                                                                                    MD5:96C569C1FF875B897A2EBDDD3BCEE40B
                                                                                                                                                                                                    SHA1:44F8019C435ECBC1B00E8F1223ECE6C42F1E9976
                                                                                                                                                                                                    SHA-256:9682AF6D55EB930C650D69D7ECD4A6101681425F4821333C4513916AE57CC14D
                                                                                                                                                                                                    SHA-512:4E6521B28184AB8D09D45FD30E96F3703ADE7F495211380DB0BA79F0372CD834861165B9D66D8CDD0A036850C9866203A6EE60642B80DB4F89D7037BA56C8BC2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................$.....@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_uk.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.574026643245629
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:QxZMuKgHWyC2EeovVHE/GfuQNyb8E9VF6IYinAM+oP9+Z9BIYiF90+1AM+o/8E92:UMu2uoEpYinAMxkWYixAMxkEw
                                                                                                                                                                                                    MD5:BB5F78643FDFBB3600ABB2D4529D857B
                                                                                                                                                                                                    SHA1:95F987F0237584B8428470EF8A34774CB18E83DE
                                                                                                                                                                                                    SHA-256:2D701243EFCC415F101A68D9A80BD1F93718DF906C5A9DF94B7C7210A72EEFA4
                                                                                                                                                                                                    SHA-512:98A80DC74B3A7FAA06401299E2260D6E5801F30C0066F6F4F3BE0B66D432E36FB72044038B839019B0EC37FB8B7317046DD69E74F2E97A7C3CA1DB277891345F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................@.....@.............................D....0..(....@.. t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_ur.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.583323336112305
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:avoo+OmAcoWACeesYQEpYinAMxYn/YiGAMxkEj:am7HxG70x3
                                                                                                                                                                                                    MD5:0E98103A45EBECEDAE05F0EB6BB4AE6B
                                                                                                                                                                                                    SHA1:4FD5E0061553B702FC058A1052B6A0CE58F470D7
                                                                                                                                                                                                    SHA-256:B5931F32C31EFFB7FC90F95CD27481DB36B6BDB31FBB982CA787794D7E51F892
                                                                                                                                                                                                    SHA-512:DC37D909B89017BB2395D8C809D65427AE8C485075FD4D725D3A9BB636A43E0540DA712026CED6BD59BD634743C3A10471D2D7FBBAAF962BAFFFB52DE7F845D6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........|............... .......................................'....@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_vi.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.499322127248548
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:ZF7ysKFjncHNyb8E9VF6IYinAM+oP983nX18hIYiF9nX/qAM+o/8E9VF0NynU:LysKVcrEpYinAMxmnzYiKAMxkEG
                                                                                                                                                                                                    MD5:7A22F812F92B7F00EF38A14A70BE3F82
                                                                                                                                                                                                    SHA1:F1D265A2C835DCDD6225889E895EEDB7094943A2
                                                                                                                                                                                                    SHA-256:B3886AF3ABCF6880516189F822DB806524564AAB38F7F9C8AF9052F632BFEA0B
                                                                                                                                                                                                    SHA-512:4B82DDE7A1FBC563D7000A034AD943B7AC562CDC8757A70E1899FB418BB7EB3632A6E2BB8227F296DA503EAF16FA3398529CA7781AF606DFC31060E71CF999C5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........|............... ......................................x.....@.............................D....0..(....@..Xs..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xs...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_zh-CN.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):48448
                                                                                                                                                                                                    Entropy (8bit):5.620247349904402
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:ZAURXZshAWB8Nyb8E9VF6IYinAM+oP9QNA9BPxo0IYiF9YU2AM+o/8E9VF0NyZg:HEAWBcEpYinAMxQYi6AMxkEk
                                                                                                                                                                                                    MD5:66B5ABEC8E4B2CABF62B68BD265A48B9
                                                                                                                                                                                                    SHA1:5CA58A3B929FC41E617F4CD205317B86E5346642
                                                                                                                                                                                                    SHA-256:BBEADD3AF22684259C95C463660AF9C35BA150A00A823B419DF4C633BD1B53CD
                                                                                                                                                                                                    SHA-512:F6958C4D687040E17B9A85DC59F26FF2E4B9321D05165946C744F97AB6D29ACFDC8DC531C3B68A25BEFF13BB566D73DC6FD95DA0A292B24F013C0270A27B0137
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\goopdateres_zh-TW.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):48448
                                                                                                                                                                                                    Entropy (8bit):5.631167984677434
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:ZuHOldGBiuNyb8E9VF6IYinAM+oP9Hs4S4U7IYiF9cO/TqlAM+o/8E9VF0Nyq2:fg5EpYinAMxeEYiV/TqlAMxkE3
                                                                                                                                                                                                    MD5:7B02084502F62AB08E9F4DDEE91A3068
                                                                                                                                                                                                    SHA1:4588AC3DE96A3DE4E11E0DF0079C58D45208BD8C
                                                                                                                                                                                                    SHA-256:8F04BB3D46A4BC4EB58A250296F6B8C97CA37FAC73319D7C7BD8D89CE9AC098B
                                                                                                                                                                                                    SHA-512:131FC0928334771CFFEA4CB4AEDF7E993CFEA819E492033601F5025C31C900413E9E534B5982040147B2D4F3EDBB764D588E78EA217DB0CA8C34FA3550EEDD55
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):282432
                                                                                                                                                                                                    Entropy (8bit):6.580618907494474
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:eRGm4nC4FXoZGxrxAO0e8x5q9Sj/aazvo:eGm4nXFXoZ4qeK5hZo
                                                                                                                                                                                                    MD5:B5BDDAF2C405EE17FAF06640D0F27397
                                                                                                                                                                                                    SHA1:4FEAD2DC9C066B21C99ACF1646D63A457E5587D0
                                                                                                                                                                                                    SHA-256:94B5ADE4D93F125632A7C8DBF79F99DEA877C28C2F40A9CA47C3C660A822CE4F
                                                                                                                                                                                                    SHA-512:D620835B8A46E2F0363B2FD1D0A38D58E4BAAA32F1B2DA0F8B9AB8286E031A8B4CA9077C53F88881ED827488C104D1EE099074A2FB7E4A786E8D12901EB4D2BA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...=..e...........!.........................@...............................P......P.....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine_64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):359232
                                                                                                                                                                                                    Entropy (8bit):6.269305509202009
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:YgW2y+X80/lGibh/Y7+Vkm5RVsMwbQYohXbBW+15qqpj/aak:/LX8klGibhA7+VlRGbQYobt5/q
                                                                                                                                                                                                    MD5:7931008AC869E46D780872FDE1ED4328
                                                                                                                                                                                                    SHA1:37B92B318D5252DDC9CAD22BCC37378124BB92CA
                                                                                                                                                                                                    SHA-256:971C492072C6E6E6DDB0B8584059E9AF58F3B089DECB151FD860599E818AD1FD
                                                                                                                                                                                                    SHA-512:E1A69A6DBF917D336F93783CB60D4D8FE5D7A2A15B2C993AA27A63DD87CFCE235BB4C9D7EC46359BA65C9D610D6CB369EA3BE5058192410C93C36B73B585A579
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...B..e.........." .................D....................................................`..........................................\......4]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..>...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psmachine_arm64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):327488
                                                                                                                                                                                                    Entropy (8bit):6.0919814113297415
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:MeyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeRobT28r5RIf7Kj/aaLA:fyDB/IMlG2k5au6
                                                                                                                                                                                                    MD5:8A08A9BBC3817967911FAEBB23D3892B
                                                                                                                                                                                                    SHA1:41D7426E52AF9E489767A87BCB3B1D0D10992BE3
                                                                                                                                                                                                    SHA-256:DF412FE80FB7C2DDA4FC6067641D8A86C53A98C8E8AF2712D657AE8610AE7646
                                                                                                                                                                                                    SHA-512:F5C77E3DA56FD9C9171EA04B2F28D20EB1B62EA82AD0CCE371896AF592E7B6023FC478343A4481F1D73678425257AFCE8A8A591F724E90CCB57EB72CEAF0B8DE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...c..e.........." .........(.......q....................................... ............`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):282432
                                                                                                                                                                                                    Entropy (8bit):6.580127272835487
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:2RGmVviIKXox+xDvAOlXMx5qNSj/aazvVP:mGmVv3KXoxefX65hZl
                                                                                                                                                                                                    MD5:51529BD404AD6A93BACC2FAA88376CA9
                                                                                                                                                                                                    SHA1:1891AFC0ADAD2250EB4F36988651039BC975BC52
                                                                                                                                                                                                    SHA-256:ABAD43AD3E27D1E6C8611AE285AD1A7C96127DF36B98DC2FE5674B511B62421B
                                                                                                                                                                                                    SHA-512:D8F63D61B6BD040FE03A14AE5DBACE73B929E9781EC64A359BF2A832F564DF6D096F0231AB0F408B60C9A6FEA1BD00B15DC0B58152F718C36F3FFA48CF661652
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...F..e...........!.........................@...............................P.......^....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser_64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):359232
                                                                                                                                                                                                    Entropy (8bit):6.269345224951521
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:xgW2yufk0/lGibh/Y7+Vkm5RVsMwbQMohQbwfE15qArj/aa/:ObfkklGibhA7+VlRGbQMoJ25z/N
                                                                                                                                                                                                    MD5:0259892D2CB710C05CFFCA79F9686FA0
                                                                                                                                                                                                    SHA1:185CB66A76CD7B26AD2EAFFF6B1222A7B6C0F309
                                                                                                                                                                                                    SHA-256:843DFFA160083155BCC046EBD3C99FA035044156C203A7AE191C629CD83A0EF7
                                                                                                                                                                                                    SHA-512:F9A0A25C5D95584055E097593F42FCA04BB4A80BA48A5AC0D592C88273D90896AEB4C975DE72CCB93886209AFFF3F18D771CA7D948AF5BB03B277250D5ED1A97
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...K..e.........." .................D....................................................`.........................................p\...... ]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..&...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\psuser_arm64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):327488
                                                                                                                                                                                                    Entropy (8bit):6.091915599984797
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0eyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeHo+TAYr5RIf7Kj/aamO:3yDB/IMlpAw5au/
                                                                                                                                                                                                    MD5:8C35995DEDA169AF62A83A5F302C9EB1
                                                                                                                                                                                                    SHA1:A45BE3269442DFC9A4D89EFF0003E2292349C2CE
                                                                                                                                                                                                    SHA-256:0C5845A003CE6480B24712459725581839E36B00514DA26D4214853107E090D0
                                                                                                                                                                                                    SHA-512:2D660FB5CEE6C99E3A6AC54872D0F404E9F7A21B141FBCC067BE40EECDEAE29AC2D1E5141211CFB704EE70BDE40C4D5336E3538F0883143245B90BBBB82F63D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...g..e.........." .........(.......q....................................... ......6.....`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Temp\GUT21E5.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File Type:POSIX tar archive (GNU)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8161280
                                                                                                                                                                                                    Entropy (8bit):6.460371542708208
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:haO8k3+oXktjNk4rljVNlKgI8YUQyn1XoJ0MXoY0jdazPbc3CkS:bSttjTjlMQ4Jg6YCk
                                                                                                                                                                                                    MD5:C69E8BD5630DF92574407BB3E2C583B1
                                                                                                                                                                                                    SHA1:E69D3D9BF35F7D68D36C62A6318DE932835A260C
                                                                                                                                                                                                    SHA-256:84833AD5A43C284CF9136BCD0387F87F5F57A50E3FD36D36B8D67CE4CE5207B7
                                                                                                                                                                                                    SHA-512:232EE15039E0C3C407A60F77E058C5BAA2D052919EAB8CBE8E48691AE783F5FEA1671687ED2A0E988F5596750298F49DE4B7DB49D89FC1C07B4F42B67509E3E8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:BraveUpdate.exe.....................................................................................0000777.0000000.0000000.00000526500.14572006453.012136. 0....................................................................................................ustar .................................................................0000000.0000000........................................................................................................................................................................MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\...........

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):302912
                                                                                                                                                                                                    Entropy (8bit):6.698956223631608
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:vwZfu+xXz86yji7+7tzuk3vbOtQtAO4D5eUdRx+Euqu7:GfuKXznyjiC75uk3CQtWD5Xx+ERu7
                                                                                                                                                                                                    MD5:565DAF0070618C3BBB1D486B0D5A70FA
                                                                                                                                                                                                    SHA1:3DF3AE144DB804EAF83BC0B89ED847380D476078
                                                                                                                                                                                                    SHA-256:03E2EA9C1BE863F1BD007AE03C06BF3187751A00ED0CF7C4DEB3750951E5B960
                                                                                                                                                                                                    SHA-512:DED5E2D3D3CA1198A576A0947127F584156919CAE2D67A688B90EBAF11C2AD8E2C50A494052245DB8A2423F90F037886A70AE2AE42EAF3122E1B1E53699FA176
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._[HC.:&..:&..:&..H%..:&..H#..:&.IO"..:&.IO%..:&.IO#.H:&..H"..:&..H'..:&..:'..;&..O/.@:&..O...:&..O$..:&.Rich.:&.........................PE..L......e.............................h............@..................................Q....@..........................................0...2...........N..@Q...p...$......T...................@.......h...@............................................text............................... ..`.rdata........... ..................@..@.data...t(..........................@....rsrc....2...0...4..................@..@.reloc...$...p...&...(..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandler64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):397632
                                                                                                                                                                                                    Entropy (8bit):6.440229620666291
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:/+n1e0P+GDRxRwwbClZ+jam+oAI5BciIx+U:/+n1e02axRJam+S5upxn
                                                                                                                                                                                                    MD5:22DB9D0D4FEC050C0420274D3073994B
                                                                                                                                                                                                    SHA1:46FAC4589B3FCEDA6076A36CC3D3E422C05FCCDE
                                                                                                                                                                                                    SHA-256:00FF35AA88B2E1C9C271365A93B019CDD3A4ACA593642712B694628D45A12C8C
                                                                                                                                                                                                    SHA-512:C22C6656073B7EC51390D900ED40C6AACB0BB19134BD210E17E1D7A2C27069A33CAABC7AF76D50DEE6BF73EBA982F31DB8AE0509CA5690D2E4A07E675C471D1C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9.......2.........k...+...k...3...k...l.......,.......&...9..........b.......8.......8...Rich9...........PE..d...O..e.........."..........(......X..........@............................. ............`.................................................H3...........2.......,......@Q......8.......T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....6...P.......>..............@....pdata...,...........P..............@..@_RDATA...............~..............@..@.rsrc....2.......4..................@..@.reloc..8...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveCrashHandlerArm64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):372032
                                                                                                                                                                                                    Entropy (8bit):6.290860581824482
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:KfMOKV6tGrZeRIigzy/zIdNyPKxtJiD6eJj3tXPPx0t1Nosmj1c5e7QTQx+4:atAZNzif5fsm25t8x+4
                                                                                                                                                                                                    MD5:C8208EF35D885AF836E6740CB411BDB7
                                                                                                                                                                                                    SHA1:82CD43B3E74C519AB6AB9E2495C0E217F61D246A
                                                                                                                                                                                                    SHA-256:780FEDCD87E2AFC1A64EA295EA1A940EA69F74B43C625B6C85C0EECFD4142472
                                                                                                                                                                                                    SHA-512:010DD5C202E313D53DCCF86964A86D5981723A28BFD64B78752FD135DEB90763A93E04A9373136DDDB19EB6109AA540EF4E30F826DF7C02EC735A65676673A88
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.........X......X........................X......X.........N..A......A.B....A......Rich...........................PE..d...Z..e.........."..................R.........@..........................................`.................................................H........p...2...P..8....\..@Q..............T.......................(...@...8............................................text...D........................... ..`.rdata...(.......*..................@..@.data....4..........................@....pdata..8....P......................@..@.rsrc....2...p...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdate.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):175424
                                                                                                                                                                                                    Entropy (8bit):6.036513000632513
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:cQPidj5By4/EeaZL8Z0BFri9WSfWJVVqH9B+bCe5kNtupnu0D6EDpf34fdjdEcRh:heaCSgfuqdB+i48
                                                                                                                                                                                                    MD5:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    SHA1:184A42476F12A89731F608C7198E47BFC35A8364
                                                                                                                                                                                                    SHA-256:633B554A26AD05C06DFE33A50F6D69E9160207F3168E15FFD3CB5652B1E8E9D4
                                                                                                                                                                                                    SHA-512:DDB593D8A6BC515DCA7A4EADB2F50C28C8E61E9A829186BE9B9E8B19371E969FE055104DEFFD8CD5CD9B48F2468EC8B3D7BF6AEE45079E445D3FE42696E2D5A2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\............................text...4;.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...0............T..............@..@.reloc.. ............J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateBroker.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):116032
                                                                                                                                                                                                    Entropy (8bit):6.62560704966013
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:oHsWPr3K6NL3FBqrx0LHu9eU53kB+XmkM/UTmG:usWG6l/q33kB+5M/BG
                                                                                                                                                                                                    MD5:612BFE378FBE209AC8584AE27640A97A
                                                                                                                                                                                                    SHA1:235AEA9A968A37CFCC8FD2C25C167EE3F8091607
                                                                                                                                                                                                    SHA-256:CA510F6779F14699708EA640175D8CEF89388D07BE2435D22775FC078C483E0D
                                                                                                                                                                                                    SHA-512:787A576E993E8D58F96EB2B0428B02AC318EABD249DCAFF26E87E6F01282CB407879D8BF280BC398D90D2EF822FDF4D11371BC732F12D8085C50DAF7F8D97407
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...2..e..........................................@.................................M.....@.................................T8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):195392
                                                                                                                                                                                                    Entropy (8bit):6.420855633369088
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:INA1+FyhLMnQtMIHh1a/r8/kGgTWZi1vnoY46u8sOMRzy+jGre:OAowhLMnQtMIB1a/ospTbohL5y+yK
                                                                                                                                                                                                    MD5:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                                    SHA1:BC2E23A3FE66D39153CE5334F25FB218D9CE4FC0
                                                                                                                                                                                                    SHA-256:ABDD09D0B7A2718FDA3FED25F0C404F228BABD83AA59148AA40BD0E4E9A937D1
                                                                                                                                                                                                    SHA-512:07992FDB6B98940D403BE1AE6A7D49706EE198DF3A18771C330CB4703C4C9E83D519B23FE5CB4B1A117E7B70BBED7EB159F962AC1D7F942C8358F8DEA7F770BB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d..t7..t7..t7}.w6..t7}.q6..t7..p6..t7..w6..t7..q6..t7d.}6..t7}.p6..t7}.u6..t7..u7=.t7d.q6..t7d..7..t7d.v6..t7Rich..t7........PE..d...9..e.........."......r...X.......P.........@............................. ...........`..................................................{..x...............@.......@Q...........^..T....................`..(...p^..8............................................text....q.......r.................. ..`.rdata...............v..............@..@.data...@2...........p..............@....pdata..@...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShellArm64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):154432
                                                                                                                                                                                                    Entropy (8bit):6.173383322052518
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:VkKhe7NGODfqGfusU730roSnXvnaaDSNcp/:hhmNFDfXfusAxSDSNK
                                                                                                                                                                                                    MD5:F0DBBAC441C6232C55D5275C77A77DD4
                                                                                                                                                                                                    SHA1:6AA9207B5E119091948CF286A98138E1D9B0ACE8
                                                                                                                                                                                                    SHA-256:1B9A4836FD73243ED7B472D71344CFE103760413334D0E5B947C87832332CC2A
                                                                                                                                                                                                    SHA-512:9FA2CEDEC9AD950624B9782F6E47B322966605A6E412034471C0C8AE52CFBA894078F53671BB6F9B72C2D9584EA879A028EE37341A694443F1A517658B4DA4E7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|.8.8pV.8pV.8pV...U.:pV...S..pV.j.R.+pV.j.U.2pV.j.S.kpV..._..pV...R.#pV...W.!pV.8pW..qV...S.9pV.....9pV...T.9pV.Rich8pV.........PE..d...^..e.........."......2...........i.........@.............................p............`.................................................H...x....P.......@..........@Q...`..T... ...T.......................(.......8............P...............................text....0.......2.................. ..`.rdata..v....P.......6..............@..@.data...80..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..T....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateCore.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):224576
                                                                                                                                                                                                    Entropy (8bit):6.731913745591885
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:XvFYwxiy+jCOCx2FssbcF8RLcul9+2+xwEJAg0FuRxqD2YqMR5+oZmYex+n1+P1/:XNYwBOPfbcF8qVtAOOTR5z5ex+sN
                                                                                                                                                                                                    MD5:6E63E263EB7CB0A31F4800D274BD3936
                                                                                                                                                                                                    SHA1:89F0AF0FB5DE7288DB94A6B4DEFB9BB474216989
                                                                                                                                                                                                    SHA-256:9D8EBA8007E48AE1FFCC28129AB894814F844AB5C5D1543A3C8CF863C0F88A47
                                                                                                                                                                                                    SHA-512:55C74E7F32E6CE21670BBA7003EBB00AC7A121A3A11B535F98D1AC3D35D1893449CA078FD093FFFCFD7547F99DB167ACAFB427F0057ABAA9115382BB0315998E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bm...>...>...>^..?...>^..?*..>..?...>..?...>..?...>^..?...>^..?...>...>...>G..?...>G..>...>G..?...>Rich...>........................PE..L...T..e.....................`......v.............@..........................p............@.................................T............2..............@Q...P......@...T...............................@............................................text............................... ..`.rdata..............................@..@.data...l&..........................@....rsrc....2.......4..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):116032
                                                                                                                                                                                                    Entropy (8bit):6.626583684028364
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:yPMWPuHKCqLXFBqrG033M+tZnkB+XmaLNrfei:MMWtCYfqVnkB+PLNh
                                                                                                                                                                                                    MD5:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                                    SHA1:4E2302B2008CD8CCA7DAECBB13D42931971890E2
                                                                                                                                                                                                    SHA-256:79BAB0D36F4682194C20694F67F1B716438E7EAFBDBB83D9681259A41276D857
                                                                                                                                                                                                    SHA-512:55A671BF0BAA2407D14872AA3ECAA485D2FC267AA57374A1E0871B5060372F8989FFF8444B65BF256A45D9B92568F9B69F759F8B1E5DACE94EE91FB0A7774F03
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f.Hf.Hf.H...Il.H...I..H...Ir.H4..I@.H4..Iw.H4..It.H...Ic.Hf.H5.H...Ig.H..LHg.Hf.$Hg.H...Ig.HRichf.H........................PE..L...4..e..........................................@.................................,k....@.................................\8..<....`..x2...........t..@Q...........-..T...........................`-..@............................................text...s........................... ..`.rdata...^.......`..................@..@.data........@.......&..............@....rsrc...x2...`...4...0..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateSetup.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1446992
                                                                                                                                                                                                    Entropy (8bit):7.913845028849878
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:w2hOU0p4qlWfBTfmRfanIT6lUScOWFohEp6Vvn6qtndPVmatCkbpmp:zhOJpP4JTm5T6lkFohDB6sndPVa6g
                                                                                                                                                                                                    MD5:E3E7498C2436A1570109FBE755AF1D40
                                                                                                                                                                                                    SHA1:D7FB79F465D2C87EF22088327B5BFB73899FDF7E
                                                                                                                                                                                                    SHA-256:498E27ED4E5BB584672992F459C0E51CD1E7345889DFF1521CCF577B13ED6313
                                                                                                                                                                                                    SHA-512:4DD6025D4EBD1D4EDEEC077EE39E8704D2ED04FFD5F7AD83934A2ADA8D0E3AEFB15841B36AD0454E0C2CD6BE12E13B2015DE322D27059CB2FEA8BB7F4A247096
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........................Z.....................................................................~.............Rich....................PE..L...!..e.............................i............@..................................\....@..........................................P..<g..............Pt..............T...........................8...@............................................text... ........................... ..`.rdata..B...........................@..@.data...T....0......................@....rsrc...<g...P...h..."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateSetup.exe:Zone.Identifier

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):26
                                                                                                                                                                                                    Entropy (8bit):3.95006375643621
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdate.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1116480
                                                                                                                                                                                                    Entropy (8bit):6.768405587681001
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:JYCOm/qiJZz4j02iDtjNDhSRXaD5O5sHG4reqc8fvT2bz9cjclU:NO8Z0jniDtjNE6Y4rNvTkz9cjclU
                                                                                                                                                                                                    MD5:36C7B693D057C28F237E57964DC3D785
                                                                                                                                                                                                    SHA1:468394D765AC4EA8A92C4B673D4A10C6DAA1CDBE
                                                                                                                                                                                                    SHA-256:A718ECF01E9E995A189A6A0F9F6367ECAFECEB7BDA16705E8B7037AB844E51C5
                                                                                                                                                                                                    SHA-512:6F3220C27BF9D44BCBA0AB1457543D29E1DD8381541624B81045D868813D5EE647035B42761A9F53D25DBFB5D00F598254E1BAF51816052929E637ED793C8E45
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......r.Y.6.7.6.7.6.7...1.7.7...0.7.7...4.'.7...2...7....4.7.d.3.'.7.d.4.!.7.d.2.y.7...3.,.7...6...7.6.6.W.7...>...7...7.7.7....7.7.6.....7...5.7.7.Rich6.7.........PE..L......e...........!.....R..........}........p............................... ...........@.............................T...4...........................@Q.............T...............................@............p...............................text...qQ.......R.................. ..`.rdata..4....p.......V..............@..@.data....X...P...4...(..............@....rsrc................\..............@..@.reloc..............&..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_am.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.575420072105715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:AR+H4k4+J2HNyb8E9VF6IYinAM+oP90at2rIYiF9qmPd9AM+o/8E9VF0NyKz7P:jHZJOEpYinAMxBYiLPzAMxkEkn
                                                                                                                                                                                                    MD5:550A1B340AB88809669FD17EC434561A
                                                                                                                                                                                                    SHA1:0F6C12C069746DB4AC01DA97185E090FF509C546
                                                                                                                                                                                                    SHA-256:3C113F4FF22B63D42E4B3351EA2952DBB1842655DD52F0F84951961CA7C303E7
                                                                                                                                                                                                    SHA-512:5AD6E4B96196B15FFCFBD189AEF474DDDDBE5E6AC3FBC49BE7EA9C99A39D8F8C38FDBF7C6D0FE20B1FF0048A2E8E0BB94631FE718C507301837B9347B3A3257E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...7..e...........!.........z............... .......................................H....@.............................D....0..(....@.. q..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ar.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52544
                                                                                                                                                                                                    Entropy (8bit):5.5725435735274305
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:J0ovtkCLu+JG8Nyb8E9VF6IYinAM+oP9VtdzACyIYiF99OAM+o/8E9VF0Nydh:PvtkCLdrEpYinAMxAEYi0AMxkE9
                                                                                                                                                                                                    MD5:BBC6198B60210C1578CBAA60B96FDC70
                                                                                                                                                                                                    SHA1:3A19EFD437D2C35CB15F2AB2D813466E8B1066B7
                                                                                                                                                                                                    SHA-256:9196D431048A4481911054ACAD58D849D9AC38715A2F164FB09CC52F5E41D105
                                                                                                                                                                                                    SHA-512:D89A7F66BF6273A0A232D543FDB98CF583B0DCDE2FFF058AA018A2368D0F0918CDCB317D0729749F490D5F6A5D9D36B04F73CB8E2CC3E3D69A123808B787B0A9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!.........v............... ............................................@.............................D....0..(....@..xm...........|..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xm...@...n..................@..@.reloc..$............z..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bg.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.5655586584292065
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Jq/odckbeGZBOcl8Nyb8E9VF6IYinAM+oP9ax7AIFEIYiF93jjMAM+o/8E9VF0Nm:yoV7DlcEpYinAMxyL1YirjMAMxkE0u
                                                                                                                                                                                                    MD5:DA09EAA0D93375AFE0709C1809C14939
                                                                                                                                                                                                    SHA1:9FD4700E02BFBB7E4C890CDD59F0620FB0F9FE17
                                                                                                                                                                                                    SHA-256:0BD086FFED7296FF1FD8228AED8F80B8D9A8E2402AB974A9258A86887347E502
                                                                                                                                                                                                    SHA-512:392C0DEE8ED74DC12978E29F5777BF5D3E93BB0F839C156951F34EAA9A72AC9F4E132A99344D9EACCD5D98AB12CC7EA5F95DC1D503B6C6CB1F4086380AAC3A96
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... ............................................@.............................D....0..(....@..8y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...8y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_bn.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.623684706857659
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:JcKhvUx7tYF7qKF0FrHF6zjbmBwgNyb8E9VF6IYinAM+oP9ndzZIYiF9wQAM+o/i:xhrlF0FrF3BwYEpYinAMxaYi1AMxkEI7
                                                                                                                                                                                                    MD5:28C55146F4311953E1CF7E468C8DC74B
                                                                                                                                                                                                    SHA1:76442CD814BE3FB21A0E2E8608E564C785548F13
                                                                                                                                                                                                    SHA-256:32216C7119BE97564830F8CBF4888632E7D1AC5F99AB65DA6C2E6A28D511800E
                                                                                                                                                                                                    SHA-512:5E13C7820218C29F26C64C12C318E40C11759B37300793F22E08F3D828361CCB1244123610B4AFE3E9E9E454263A862D136A96E4271B51378C50E8D2F8A83D47
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...8..e...........!......................... .......................................{....@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ca.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.39160458880719
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Sv2ArBupGEEpYinAMxVYiDWdSAMxkESKM:Sf397HxV7DWGxuKM
                                                                                                                                                                                                    MD5:44ADDEF5DF612EF84086876FFA323A76
                                                                                                                                                                                                    SHA1:CC7639439B15CAF8FC8F9240BEF8B757BB3054A2
                                                                                                                                                                                                    SHA-256:108525B759F60C5076BACA70474640E1E262BF77FF3F1A1E7822198416084D55
                                                                                                                                                                                                    SHA-512:7211E8549A4D6A3BD6C425DA1065F8AE0DAEE1C7325D63A8E8535FAD7464A2043CCB5F379310AB4A22C4498728F3317B79F260C097CCC652817FB521D317106F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!......................... ............................................@.............................D....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_cs.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.442186434885563
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:OUBDBWpaJkhYwA+fwNyb8E9VF6IYinAM+oP9gpY83AIYiF97XAM+o/8E9VF0NyFx:huIEpYinAMxZsYiDAMxkEpb/
                                                                                                                                                                                                    MD5:68BF6960F7C5BF7AE817EFFC7632C017
                                                                                                                                                                                                    SHA1:F828B622D95F69222B68BBA9FA9F400672C84569
                                                                                                                                                                                                    SHA-256:5314C94178A6861A88792F34D924A56B5CC7214CC4351AFCBED536D5C3F13417
                                                                                                                                                                                                    SHA-512:71C84ED4417ED943EF752CDAC0D9E57FCAFAD80B3B16A2EE515734BF3A12F335FB9E4B0BE86DB1B607CF4E951D4306626C15C166C11579BBD0B866756D0DE53A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..0u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_da.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.409036773195985
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:O7aUfNnwtpTqPqNyb8E9VF6IYinAM+oP9G5rJXEuIYiF9YabOAM+o/8E9VF0NymB:X8nw/+qEpYinAMxgUjYinaAMxkEm
                                                                                                                                                                                                    MD5:6ECB0249DA48684622FE633F98F8F530
                                                                                                                                                                                                    SHA1:1B9990DCCCD813FAC7C5517A03E5C147816E486F
                                                                                                                                                                                                    SHA-256:0A52E3DC70183D8041683817CC0514004898E87D9C080FB93374E900660BBC0E
                                                                                                                                                                                                    SHA-512:E48932205ED3362B4C915C572FCAAD012205837F54520F66C33B12F9AB4179E03AEB559C18465E3C419242CF039DA5C0271FD2CBC0031F1E7C7594C71CCB75BB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...9..e...........!.........~............... ...........................................@.............................D....0..(....@..xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_de.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56640
                                                                                                                                                                                                    Entropy (8bit):5.377480288938011
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:XKjmxUM8QtPM0Me6INK/AGNyb8E9VF6IYinAM+oP96jjjIYiF99hJIAM+o/8E9VF:UmXjMePsAOEpYinAMxaMYivuAMxkEhJt
                                                                                                                                                                                                    MD5:BAEA28AE8DD3E3C70DEBCDF1AE5448B4
                                                                                                                                                                                                    SHA1:F8F40C17ACE4FBF272618063BC35F2502B00ADC6
                                                                                                                                                                                                    SHA-256:4C2DA183A792B13077B398085CFF930CBF493B8CBEC50609F2BC6747F0B8092A
                                                                                                                                                                                                    SHA-512:04DE4F7FA8C4A625724337539EFF093E2371ED417A6363833E7F65CBD14C9A0F64BB17EF1BA4BF51A16D6611E8240E4D2B248E4622BAB462DC331459DF64C851
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_el.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.627688222986176
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:8Zr5lLO+R52/g4EpYinAMxSKYidzAMxkEd:2rl7207Hxt7dzxJ
                                                                                                                                                                                                    MD5:5FBDD326F7F291BE11E1D79A7B2C8A51
                                                                                                                                                                                                    SHA1:5701E5D3496F6D2F0C694D317F568A63990C311F
                                                                                                                                                                                                    SHA-256:1CB97FF90568D81F8CC9E6A2EAFB07EAA276834169365980279403D99756103B
                                                                                                                                                                                                    SHA-512:01BC099E7C875D6A0473F6FF577F14F3DA3123951596B5651BC757B6A2C10F293078452BB42A87084C3B862D4A0CD56129670234D2E9518E76379C534B534AAB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!......................... ............................................@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en-GB.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.419932966591344
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Xy1/Nagyh6QuZNyb8E9VF6IYinAM+oP9p91J3ZIYiF9fAKAM+o/8E9VF0NyUNk:uNagyhi9EpYinAMxVGYiQKAMxkEYk
                                                                                                                                                                                                    MD5:4396E672BC6FB86EDB0C6889D12CE082
                                                                                                                                                                                                    SHA1:C92279D00DBC2DC0EA13E3A8896EDA76A359723D
                                                                                                                                                                                                    SHA-256:F35E94567279C322EC1D4BB99EAA1327FCAA1F06F4BD9D1CEF8C897FD8BDA8C3
                                                                                                                                                                                                    SHA-512:45F40EACE1C0398EBCA42EFF48DE6208BC87147837459AEE6D882CD017A9069CAD2EBEFE8B1EF0D27F36981DDD963416F0B7B5A26AF98A84B6CB64666638D0D3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...:..e...........!.........z............... ............................................@.............................G....0..(....@...q..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_en.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.398655575356968
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:8VgzagyWk9RUNyb8E9VF6IYinAM+oP9BCDvCIYiF9L3qc2AM+o/8E9VF0NyQr:NzagyW4UEpYinAMxmYiOBAMxkE2
                                                                                                                                                                                                    MD5:364F97EE7B79DEB51DCC8F5EC4A0EE7C
                                                                                                                                                                                                    SHA1:EC4CACCAA57714FA8B9869315B6B13C530587E2D
                                                                                                                                                                                                    SHA-256:DE1E4766E0A2C188604AB2927025E1F5B05CEBF7E7B20E8342B4206686A7EB96
                                                                                                                                                                                                    SHA-512:43894949B412A8ECA8032F68DAC6C9208D9297B8C0353B9BBACEFE13343BB94343569F4CBEE1AC2B90971C8E2CC81408C55FC57DFEB94A6297D28CBB43E4D1E6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es-419.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.391103646647603
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:8Uil+fs4INyb8E9VF6IYinAM+oP94Y6uFkJIYiF9EW4EVdAM+o/8E9VF0NybJ9:Il+fs4gEpYinAMxnZYiWELAMxkED9
                                                                                                                                                                                                    MD5:C2E2C6690755507979F570CA3E92E903
                                                                                                                                                                                                    SHA1:F82052FC3D2C97C18CCAE91CB64C91F02DC09AC5
                                                                                                                                                                                                    SHA-256:FD60F26D62F58D1AA41D11A8AD3086E2A0D92EF22AC766F606AEB2BCC3B217EB
                                                                                                                                                                                                    SHA-512:319A6418576BE4274269F533A5CEF62F9020B606494F3C7A5B299957931B919A86507F7888EAB5C6BB952BC65DAF76AE89439E72778BF97F77B30B520E904148
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................H....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...8........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_es.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56640
                                                                                                                                                                                                    Entropy (8bit):5.365606356097874
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:86qBkNzf1FNyb8E9VF6IYinAM+oP9FVIrIlppcIYiF9kSx6AM+o/8E9VF0Nyueu:KBkNj1BEpYinAMxI2Yi1oAMxkEq
                                                                                                                                                                                                    MD5:91C76FBA7736D06307708EE572CB9ED4
                                                                                                                                                                                                    SHA1:64764FCB44F18104E7554D8091BD0C7EDAA9D1A9
                                                                                                                                                                                                    SHA-256:D62078627149F4B5B90EE68B56C640CE120519F2F0438FC136AF225510CBD343
                                                                                                                                                                                                    SHA-512:F789D42681BDCEE52CFD342F019A16396DAE0E3F8C929A1A004E1F9F960EC94BE72B40E8D22A0DFEDA1F743564568F457EA64A6C6E5074F323C4655964402097
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...;..e...........!......................... ............................................@.............................D....0..(....@...|..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....|...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_et.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.407227689072818
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:VYBW7bDFbDZETJ9TSQMNyb8E9VF6IYinAM+oP9I6UwqLYcIYiF9sx5q7AM+o/8Eg:Sm96nHMEpYinAMxTYiOYAMxkEg
                                                                                                                                                                                                    MD5:9599F4AEE019804B418245C5A86881C7
                                                                                                                                                                                                    SHA1:517D4DDD90361B89359BCCC174D9A6ECDA391426
                                                                                                                                                                                                    SHA-256:3023BFEDCD84AC065A38C4C6C983CCFAA0B3D5C02A610C6CA2EA00FD5545DABB
                                                                                                                                                                                                    SHA-512:613C6F11D11D84C1208B1CD7BDF030C3D2F5B90BC4D134C6E0584121B688AD14B01CE38C56501898962F5C859A8AF54248E86F510C20F3F7E0415163FFF95F14
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........|............... ............................................@.............................D....0..(....@..xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fa.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.562768970202109
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:VCYQOZMK9Y5fNyb8E9VF6IYinAM+oP9eLcfiPdwFIYiF9EbrJAM+o/8E9VF0NyXe:c1VBjEpYinAMxMcqPVYicxAMxkEg
                                                                                                                                                                                                    MD5:A09A6C8DC7CEFC6CB126939947884678
                                                                                                                                                                                                    SHA1:16F90FF84A3CD8C98304459007C7D05A98D05CC0
                                                                                                                                                                                                    SHA-256:C5CFADFE624A0B92B45B121DC30D06D89150BDB03FD45B4FB7B4534BBC7EB40E
                                                                                                                                                                                                    SHA-512:AF6F3BE99AEA54D26E933C98695644596D814E4E8B880E5CE081093A474FB8DF973853DE5220E498ADC84FF752CFD1CA4165771F04048CA9ED7CB6C179050798
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........z............... ......................................q.....@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fi.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.408662294317196
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:V1HzPEzPhXY7RzYd99hKh1GAsNyb8E9VF6IYinAM+oP9BSzehCaIYiF9ca8lAM+c:PzPEVmKgsEpYinAMxqzTYin8lAMxkEsI
                                                                                                                                                                                                    MD5:1DFC8B3110BA27F76C5C6495533AF538
                                                                                                                                                                                                    SHA1:DD60677F7AED0FBC06877333136562EDAF0BAECA
                                                                                                                                                                                                    SHA-256:60A159777971A84302E150866CAE1339ADC04939BF12B7B2367243361499BBF9
                                                                                                                                                                                                    SHA-512:37674C26A179B839239337219EAF8F78AEAC10425DE5E7CC5A91B140B816410EEC5C4DE84E7BE825BA4CED3AA41F1B421B1902D26C5A9384C725C5682017ED72
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!.........~............... .......................................G....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fil.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.386310916321289
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:D7U9w+B3RVawWrEpYinAMxmR7zYiyOAMxkE8e7:D6w+B3RVawf7HxMf7y8xN
                                                                                                                                                                                                    MD5:20152624A1FF01D9F2BAC28D7B00CCA9
                                                                                                                                                                                                    SHA1:A320967BEE24E07725E3AC2DC2F66F264F1B9221
                                                                                                                                                                                                    SHA-256:80063F2CA78C9C757FB06B36F24F0347992DD75D300C4FB4A0DAA90D31B83A2D
                                                                                                                                                                                                    SHA-512:A9334CC7D97A212F816EEAC0EBE8D6A5CC4B83C72DC10C34682AE504EA9690C077A84246DBA1462E991C609431CC93B085ADC14DAE28D468B537305161D56EF7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...<..e...........!......................... ......................................-.....@.............................E....0..(....@...x..............@Q......$.......T...........................`...@............0...............................text...5........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....x...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_fr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.3857985161200785
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:qqov98EoycpW4xUNyb8E9VF6IYinAM+oP9HaOp/IYiF91ihkAM+o/8E9VF0Ny3j+:OvaycNUEpYinAMxoMAYiAhkAMxkEt+
                                                                                                                                                                                                    MD5:7704C15C3F3F312CAF2849DC2EAB0E78
                                                                                                                                                                                                    SHA1:E3C673D407464CCB1E2DF5FC357D814C61213F7B
                                                                                                                                                                                                    SHA-256:FE634E2F6C7AD7BAD17BD0A956B612BB14A9064B98CF5B5E013E08AC19204744
                                                                                                                                                                                                    SHA-512:704A7541B55962E0DB1BF9388DA3F8A2AE1AE284AA60409D5FBC30F9BE275658D10C2DBFA80DED9F12632DA0F4F076925B5658B4F16EEEDD5320AFEADDEDCE85
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_gu.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.61051850410968
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:q6qm3UbeAV4DnYCRfwmkIPNyb8E9VF6IYinAM+oP9iCpiA4RpIQnBIYiF9jdiAM+:EUUbe7hbzEpYinAMx07nWYi0AMxkEoem
                                                                                                                                                                                                    MD5:41B7CEF8A631E5F9FF1B54F6B0CE13E7
                                                                                                                                                                                                    SHA1:8B695116808D99DE0B49EB54FF8AFA9A6E81368B
                                                                                                                                                                                                    SHA-256:3B5FFC2C6DCE2BE431CF686FCD2D2CD39FF003D42AFC27887CB128B34CBEE354
                                                                                                                                                                                                    SHA-512:15E72B1B3FDEB5A7AC2C4AB044224D25521A820AE62C725ECCAF6E3E2C1CDB24F9EAFB3AA12E1C1ADB042E762D49E0FE6A3B81280D1E5346BCDBDFFB8712B6FB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!......................... ......................................1.....@.............................D....0..(....@..hz..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hz...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hi.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.584260993420684
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:j4x6AN6AQqjexbyqKXhHqC1EpYinAMxlcYiXl2AMxkEb:j4xXc7Hxlc7VExH
                                                                                                                                                                                                    MD5:5EAF10368F71EF58845D728B1C35DEDA
                                                                                                                                                                                                    SHA1:1D525E25F5B1B2546285B0BCD18BE0D2F81F17A5
                                                                                                                                                                                                    SHA-256:E9FBEA12B32D02160D14370501A622C032114C592EF7C5BF94EB620283FCB6D7
                                                                                                                                                                                                    SHA-512:94B31603651BC5A3BB51E44E07AF1BBDB4B6D9EAF5B0AE7584525155224F23F653AFEA2DDA885620C6362D8CEE6189C5B6C86C2D76E2CDB541415A604A4B1FE3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...=..e...........!.........~............... ......................................#P....@.............................D....0..(....@...t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.402610840778619
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:TsfBpdOXz19szMH5KBL/yNyb8E9VF6IYinAM+oP9I2ZlxEIYiF9GTJAM+o/8E9Vz:GBK5oL/SEpYinAMxPYiSJAMxkEn
                                                                                                                                                                                                    MD5:615FEEC50393BF657E7B84A864D534A7
                                                                                                                                                                                                    SHA1:0D3807C4E28D0121C43B3A910BD4538DEEC70B5E
                                                                                                                                                                                                    SHA-256:6EB847167FF384D1D30B6D16939980DC89D95547A18CBA91136CE66CEF6C06B7
                                                                                                                                                                                                    SHA-512:76FEF42FD098DAEAC39B495C5AF7E71784204936D4D75483BB49678C3995C7FE0FC3B75F5D2E034FB974AFCFE45FA4158801C92F0A55441C5E8CD34647142AFA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................T.....@.............................D....0..(....@..@v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_hu.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.425116799449756
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:Q17U791C2TzpwGFTbZY6d1lBVZ5qAy3FGd7HxQ74xXa:Q17U791C2TzpwGFTbZpd1lBVZMAy3FG2
                                                                                                                                                                                                    MD5:E200F70987E56CBDFF8C6A587A02705F
                                                                                                                                                                                                    SHA1:8C135AD82792C337445DAB4677B654C7390BF36F
                                                                                                                                                                                                    SHA-256:B285107D2D2F2D64F2F060CF57E29B08C5DD9498CE8CEF83ED7C30032CE4625F
                                                                                                                                                                                                    SHA-512:81163C216A1D4FB7B328D4982F4A251601242320EB413B88F423CB133526484667328716D368DAC110E6E2E4715814A8A1A85BF56A81C42DC8E48049DECDC767
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!......................... ......................................_.....@.............................D....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_id.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.402370571282084
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:TxFmhL3THRNkAHqQ3lFRf2I9ByrUvNyb8E9VF6IYinAM+oP9Lfu7byIkdIYiF9X0:WXhR5TEpYinAMx8oKYitAMxkEc5
                                                                                                                                                                                                    MD5:16C771FF09E9BCFE7FD617C0F5D489AA
                                                                                                                                                                                                    SHA1:55AC69B62DD357DE4884A95F95786AF979F2CFE2
                                                                                                                                                                                                    SHA-256:6F747BB6BCF0491A3B7F2F04B802C41BD895A01D94F11E7E5B6721B17DEE26F7
                                                                                                                                                                                                    SHA-512:D85B041F62241EC6F4685372895200FECCC1F277F1E0D4A5015AD79CEA12FD19BB4B864EF871A4F6D7B4C0D887F4F92FAB74BFDFA7940B07866B063464749C4F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...>..e...........!.........|............... ......................................z2....@.............................D....0..(....@..Xr..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xr...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_is.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.42997837750232
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:gJqibAIErkUVQF5UefV3BEpYinAMxxYiPAMxkEA:gJqibAIErkUVurfVa7Hxx7Px0
                                                                                                                                                                                                    MD5:1844776B1E873892CB6D453EBCA334A2
                                                                                                                                                                                                    SHA1:6F36F4BF2CE6D286C0E1E59041EE506BBB96ED7D
                                                                                                                                                                                                    SHA-256:98E823748DC2E72B8B5A46827D501E12C9C48E209643F2DD6B4B8D333501DF8E
                                                                                                                                                                                                    SHA-512:8C48EB7CC40EF6798C9789A9B860BCF508D3740E948FE64E1197A422CFD240A6430FC36B5AFC23A5C1CA73FB155003B22A57AECEB207741BC9EBCAA947A411B6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_it.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.3695383590059125
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:4SIlDIN+shh3+Nyb8E9VF6IYinAM+oP9BNgIYiF9zMAM+o/8E9VF0NytlR:UVIN+q3GEpYinAMxPYiIAMxkEP
                                                                                                                                                                                                    MD5:E7A5254E3C732ED21F756B90EE6C73B3
                                                                                                                                                                                                    SHA1:EE2C5D342E51BE27750F5C855A9437B6BF3FEB86
                                                                                                                                                                                                    SHA-256:9342ACA1761B4F81F8771F19CB4A1ABD77F392194D32758FF42B98F8AA3D6CB5
                                                                                                                                                                                                    SHA-512:75F83A5905F8254E4FB352D00B8173D2A5614C17D166C06AB87C0B67C1C7BDF99377C7BBB89A85E6AFC5F0E5F8A045E45D64B2B157A413E871C015EB65D46F3A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!......................... .......................................a....@.............................D....0..(....@..@z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_iw.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):52032
                                                                                                                                                                                                    Entropy (8bit):5.602368818487498
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:4cKIv7hdVexaDywGfJssDNyb8E9VF6IYinAM+oP928tt+fIYiF954AM+o/8E9VFt:EgNM1fEpYinAMxZRYieAMxkED
                                                                                                                                                                                                    MD5:0DC19E59ACEDB7D103D0C21B02804661
                                                                                                                                                                                                    SHA1:477FEAD06B9DDFB85185DA85A640E6BB467FC32A
                                                                                                                                                                                                    SHA-256:17ED8A04CC1BCAB734F23140BFC8145BD0D038C284D50F439DAD1E66F7647C22
                                                                                                                                                                                                    SHA-512:20F3E9B58E9D5AE3F08096ABD5D5A43DB93238FDCDF2E96126A4B4AEB06BE2C8ADDDDC6601136EA265770AFCC7F4BE41E20F1D28CA361FE0135FC98BFA71F392
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...?..e...........!.........t............... ......................................nn....@.............................D....0..(....@..@k...........z..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@k...@...l..................@..@.reloc..$............x..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ja.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):51008
                                                                                                                                                                                                    Entropy (8bit):5.615534777551888
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:hz7iEHj0FgWGNyb8E9VF6IYinAM+oP9EimJIYiF9mRDxAM+o/8E9VF0NyzCU7rR:RiED0FgWOEpYinAMxHYiWDxAMxkElt
                                                                                                                                                                                                    MD5:6C6093A914A889BC15133A57DB09C395
                                                                                                                                                                                                    SHA1:A8F9D54288D636E586271D78E7CF69E9E0121E16
                                                                                                                                                                                                    SHA-256:EC7AF1E9B03241F85A99F9C807FE279E322CA5528DD08B33F65D0CEFB8F04EED
                                                                                                                                                                                                    SHA-512:3548503A8395ABD3D19D3FFEF24832242F6F6C742678C0657FBF795DD14584B9F35BE5B02D7BC6657D486E63609E0687C1E277857DBEFCE6AE7D97E6E135605F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........p............... ............................................@.............................D....0..(....@..@f...........v..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...@f...@...h..................@..@.reloc..$............t..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_kn.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.638575498464374
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:hgLfUIRBSWNyb8E9VF6IYinAM+oP9BGv0Xs8fIYiF9ngp+AM+o/8E9VF0NyNwZ:cfU8k+EpYinAMxq8TgYiop+AMxkEo
                                                                                                                                                                                                    MD5:12B9BE5F0923BB2313C68BB46A069F4F
                                                                                                                                                                                                    SHA1:150A975918C1435027F295A06058C5BC110B4AB0
                                                                                                                                                                                                    SHA-256:DCBA408E4AFDC0831CB26D08EC05EA0616F14071E81ABAC8FE5676636C2EE151
                                                                                                                                                                                                    SHA-512:1CFC30E83851456DD3A5925925E34AC12F7148E20F487CDB82E0F01E06DD77B6411CF03B2094C11DF9566B1228A97024065A78F77100493902BBBEFDF6502D27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!......................... ......................................n.....@.............................D....0..(....@...{..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....{...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ko.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):50496
                                                                                                                                                                                                    Entropy (8bit):5.652443774196828
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:hUELKTd4IY+N1vZsYoRHgA12plxB4xRkkTY1M5tkOANyb8E9VF6IYinAM+oP9cbA:HLKWmAf/jv4EpYinAMxhOHYiSAMxkEp
                                                                                                                                                                                                    MD5:10BAD5A24446C6E00AD2C18D09B000E0
                                                                                                                                                                                                    SHA1:FA030AA1F64894829C0CD8211488B38A18D12297
                                                                                                                                                                                                    SHA-256:91649E91509AA7200BB669AD2F5F6788EBAD7C5AA2CA6D7BB855E9FD96D010AE
                                                                                                                                                                                                    SHA-512:6AA1E426BF7AA470058810F0515A94C1F6D624B4FF3D99BBA09C850FD17DA4A2C2C50BDEF44AA28BBB3358486844520C46482FD7295B9EE50CCC8449940016F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........n............... ......................................P3....@.............................D....0..(....@...d...........t..@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....d...@...f..................@..@.reloc..$............r..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lt.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.426785047163885
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:X1ckHz05TmDq09ZEpYinAMx7b+YivPAMxkEkt:X1ckHz05+i7HxG7Hxwt
                                                                                                                                                                                                    MD5:74838014C6FDA1D53C8EDC8679F9D28D
                                                                                                                                                                                                    SHA1:491C640873E70CD0C703C57DB6F0FDC941CBE7F6
                                                                                                                                                                                                    SHA-256:6AAC9D75D6D02884C5CB5EF33A4BD1801D9BE70DD937C624F21E492F64CADF68
                                                                                                                                                                                                    SHA-512:ED792A4B625D889D8D17AD1DD23D0CC015F28B3DBCA5CD6C525E8C814996B1F806855AC4B9D59758306BE5F6F0C09979D1ACD64332E24F4C3358C5FD6857A22B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...@..e...........!.........|............... ............................................@.............................D....0..(....@...r..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....r...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_lv.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.43355377301059
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GQQpZyAxOeK6eDNyb8E9VF6IYinAM+oP9l4ZCIYiF941WAM+o/8E9VF0NylkC:IdufEpYinAMxWYiSWAMxkE0C
                                                                                                                                                                                                    MD5:8FA152CA88C3108EFE077F57482BB42A
                                                                                                                                                                                                    SHA1:B27058398730B18E39D9E16FBFBC5625AF403FF8
                                                                                                                                                                                                    SHA-256:01C42EB00F2E6566D3FFF4AFB0B2C2FAF34C14A1A61E29DB86B3CB76D4EFBFDC
                                                                                                                                                                                                    SHA-512:81620FD3D80A1C245BCBD643D1B579E3D413B3A0011AC65F39CE31929908FCD95C1D4C0D5BA89A1F907E02E351CE5EE2CE79B61E7176CA9706908BCE7A4BF59F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................n.....@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ml.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):57664
                                                                                                                                                                                                    Entropy (8bit):5.590444403006137
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:G3zU3B7FZygp8/JLONyb8E9VF6IYinAM+oP9OFIj5iIYiF9ImPAM+o/8E9VF0Nyv:JRWJL2EpYinAMxpYifPAMxkEeC
                                                                                                                                                                                                    MD5:F693B959CF8C7341020D18ED345AD74B
                                                                                                                                                                                                    SHA1:FD57E1806796F23C639531E6DCC165FCEF4F37BA
                                                                                                                                                                                                    SHA-256:0B37B36D43D032BFB68F06173107AB58E8C17904C3D1247C32690E168FA922F2
                                                                                                                                                                                                    SHA-512:E474312498C874EF53A1FCC75A9D28A35341577BDBF672FB3D82D76A2BD9BFF6BE9477A61C64D1EB434FCB9FAC7B65912E033FDEF8877A681C614A035C01E347
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ......................................c<....@.............................D....0..(....@..x...............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...x....@......................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_mr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.588716592426551
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:GfvCdo/7JK7bABkCNyb8E9VF6IYinAM+oP9644k0VwIYiF9QqoAM+o/8E9VF0NyZ:uYo/7JK7b5CEpYinAMxmvYivoAMxkEBV
                                                                                                                                                                                                    MD5:0DC5183697F790CF937860F9F8CCF8BE
                                                                                                                                                                                                    SHA1:531C04F6AA3B363A14740CC33D1E4D98BF857BC7
                                                                                                                                                                                                    SHA-256:8176DA09CFF7F0BAE0AA08430CC4CA093A68627FB631A377DF0EC82959E7F634
                                                                                                                                                                                                    SHA-512:E58A71558240BEE892FB783E061BF481CC2F56F01BFA5F7A2C50C0EC69B2360AB9564E80C3D34ADE0296DB1D9509861484A3D6AB3936880AF9D23CE13FF1A373
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...A..e...........!......................... ............................................@.............................D....0..(....@...y..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....y...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ms.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.4114238474999805
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Pr10IePeyrQLtUv6oNpaMkYjZZ/fbMgTRlREDNyb8E9VF6IYinAM+oP9LeFFjUIX:qjTZf3TFGEpYinAMx+jlYiFAMxkEj
                                                                                                                                                                                                    MD5:742CD3150B436B909E5AD9AB6F22783C
                                                                                                                                                                                                    SHA1:474B8B3B75CFB25C90EB33E8E4BBCCB07068DC8D
                                                                                                                                                                                                    SHA-256:E537F7AB167D50E347B359AB848C46405C7FFD067408E896858C31AA99E6B228
                                                                                                                                                                                                    SHA-512:CDD492F93BBE49F17DC8DBAA19C1FE1FB1B3403054703D20402B07A42BB5D5F5D20F1D126103AF0DCE62EA36299835902E7FAFF96EA5D7EACD59974E6F88A2F2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........|............... ......................................?_....@.............................D....0..(....@..Ps..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Ps...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_nl.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55616
                                                                                                                                                                                                    Entropy (8bit):5.380500350214481
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:P/kLXd/T3kXNyb8E9VF6IYinAM+oP9e8Kk6U92ZHIYiF9524AM+o/8E9VF0NyZwS:ULtgbEpYinAMxPSUTYiFAMxkE0S
                                                                                                                                                                                                    MD5:A54633E30C2FFD23C3578C885E0E9F5F
                                                                                                                                                                                                    SHA1:662988663B27C21A0CC310D304346466EADD76A8
                                                                                                                                                                                                    SHA-256:3FB8523B91B2BFEE51CA2EA972ADA260F27BA389EA9E1DD7CB8411F21F126CA2
                                                                                                                                                                                                    SHA-512:AF9213815F634BC3A1DAFDF0D2BE537E4634D690C118090A81DB1138130504B4EFD27D9D0599F7295B06A5BCCE44B71E200574E583C820E820CA84D72D6E492B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!......................... ......................................D.....@.............................D....0..(....@..hx..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...hx...@...z..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_no.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.41113033461094
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:PZ75JZSiyCSiykeRAYiTvaK3Q3Nyb8E9VF6IYinAM+oP9P+6kIYiF9+60/AM+o/d:xeCYGiK3Q7EpYinAMxtYiWlAMxkEh
                                                                                                                                                                                                    MD5:A78998736B54EC264AD3FA9529693C8F
                                                                                                                                                                                                    SHA1:4B468CCCB8AC25C9E9C05161DD5C44E08504B41A
                                                                                                                                                                                                    SHA-256:EB3F06A4EA447CE64971673C50CCF83E2842303F1A27655F3A170495C94B71C6
                                                                                                                                                                                                    SHA-512:F747EC1B69B931D90EF4CF31A5F8E7BA95B6AEC7B36299A0E988B1D4790F42BE8AF698FE66032324C9634E5A44FD251D7BCBFEF9C5529E7D2368FFA38CEB5962
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...B..e...........!.........~............... ............................................@.............................D....0..(....@..(u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...(u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pl.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.433825393956769
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:Uym9mn7KZHCCA7U8Gp6hNyb8E9VF6IYinAM+oP9LK5SIYiF9YjAM+o/8E9VF0Nyi:SUy3AIylEpYinAMx0YiCAMxkEU
                                                                                                                                                                                                    MD5:E73CF3871B41E0C59440C8D709CCFD75
                                                                                                                                                                                                    SHA1:8428813368197AEE8E3C2BF2104297476BC4608F
                                                                                                                                                                                                    SHA-256:AD124B0646894F3BFCB61D366D7BA5EDF4978766807B5422AD1778509231679F
                                                                                                                                                                                                    SHA-512:A31E82503BB3D8E1DB9EF4C1030ECD481396183CC64905FAF91E52F9C3E68469FDF3A850357AD70466D2810855D2B58E19B9302499D2547F85A610B1F8159FF5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-BR.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.4115414787256
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:UYnLplZcOZX8mNyb8E9VF6IYinAM+oP9m675zIYiF9cHymAM+o/8E9VF0NycBM8s:3bguEpYinAMxJiYiEAMxkEI7s
                                                                                                                                                                                                    MD5:0227D71A996FAB2B394DFB17A43F1F8D
                                                                                                                                                                                                    SHA1:DA6002C093911114035CBD5D7D29FA51E3DF2C45
                                                                                                                                                                                                    SHA-256:290A463B8B11E5F5C5D3BCC2B5B8D910721BA645E2B4B3AF951223F76610BEDF
                                                                                                                                                                                                    SHA-512:FB95F13C4AC6A7B8AD13F271EE3D93ABBD5E0713F0C0DE402D7B73EC82B483A26C6B071ED5521914E34E74AEF168F9FA0762801FB37EAD9D05CD3D675AE2CCFE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!.........~............... ......................................W.....@.............................G....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_pt-PT.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.392362813870133
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:UaAtOstnEx6ewB/Nyb8E9VF6IYinAM+oP9/KlAIYiF9J3ReAM+o/8E9VF0Ny1SX7:w/Ex/UDEpYinAMxGYiNgAMxkEC7
                                                                                                                                                                                                    MD5:962BFFC6EC3DA987471851A4240AEB61
                                                                                                                                                                                                    SHA1:BA1B8AFF4FACD861553039A256A7623ABF30CD66
                                                                                                                                                                                                    SHA-256:3BD318A0867F1C971DAAE6A96C6EF2A09FBFB15EC5B3706DA34453410EA1F4FA
                                                                                                                                                                                                    SHA-512:D975EE07C82CD658E4A3B6CF67BBD8FD41D989D718E5EAD479E0250BC3C66A933FD0E8B1DA468E0C906986AEE58E3C0F148E4F8A23B19121844F5847E1AE14D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...C..e...........!......................... ......................................K^....@.............................G....0..(....@...v..............@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ro.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.412695960496245
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:5nCRNNDM7qm0GdVqT541naEpEEpYinAMxmYiTAMxkE0:5VdVqlca67Hxm7Txo
                                                                                                                                                                                                    MD5:54B9FDA6AB88DC9EF0F0C8B19EA06CD0
                                                                                                                                                                                                    SHA1:C34D52741A8986FCF0991A4CECFE1B2A7C6E85AB
                                                                                                                                                                                                    SHA-256:1F00F564F1136096FBE58EFDB22E54923E090BA3392CDC51C837A7294A3FD5BE
                                                                                                                                                                                                    SHA-512:BEFDF3BAED01EA905751CCE248E854CDC43D5A9D77B2EBD27E68C297464A5A0AC1ADF739E8371F0C731A5A7ABB83E6FA227D11120F70D668113F69612D44B6E9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... ............................................@.............................D....0..(....@...w..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....w...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ru.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.578353591774595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:tlWSFA47AvHlho4d2hNyb8E9VF6IYinAM+oP9Hn737IYiF9iFAM+o/8E9VF0NyfL:qvvHUlEpYinAMxF0YisAMxkE+No
                                                                                                                                                                                                    MD5:DD650BDAB776FD3239AAD311BC8CBBD3
                                                                                                                                                                                                    SHA1:583A340581B2A78DF490951FFE6A7BEEBB51BA11
                                                                                                                                                                                                    SHA-256:475B114201EC72F4EF26FC66B61AF438CE77F69E5E96D3CFC8FB00BA148AAC51
                                                                                                                                                                                                    SHA-512:862313704DFFAD1AF1FA72D8F9F1FE4757A9A1082BE41C78E5C307C56F36D986D1F5580922800050E08BB37ED2EB18A6FF629131199E41350A22EA230DD6DC9F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........|............... ............................................@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sk.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.437717171626643
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:t4lmP8uhJPiR6gLTmNyb8E9VF6IYinAM+oP9AWB5BGJgVIYiF90xFNAM+o/8E9V2:uMF8RjuEpYinAMxlgqiYicFNAMxkEAR
                                                                                                                                                                                                    MD5:DC24DAA70A6551CD038929F3EC055306
                                                                                                                                                                                                    SHA1:99843D43C0CC3D4C76A5C817CA4DB49820820C65
                                                                                                                                                                                                    SHA-256:847440B8D60A11DCE3E254916E5CD926D58C9F06F0D95436B62FF9B9AAAEF4B0
                                                                                                                                                                                                    SHA-512:451C21F435A451CC4C47623D028B1CF3939CB59B9F9A6D6D71B2F94F9B4CFD487A8756ACFF27768B454F23F2D501E9AFC67E586F9C005142CBC712E5CEDC2D9C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!.........~............... ............................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sl.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55104
                                                                                                                                                                                                    Entropy (8bit):5.399846673022657
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:tkcnTcshVyigOHHTpWBdH1i2IXousrNyb8E9VF6IYinAM+oP9z5XKiS9IYiF9JJd:v+hOHHy1YZsnEpYinAMxfXvYinAMxkEP
                                                                                                                                                                                                    MD5:FA0AFF0B7EFD37A6195AA454012095E8
                                                                                                                                                                                                    SHA1:EF4A3CA1608A8FD5DE56B2B94DBD46304480B375
                                                                                                                                                                                                    SHA-256:7580B1B666C4A6DE0EB5AD03DAFB2F9FB49AD148754A68611E9988ACBBA5023D
                                                                                                                                                                                                    SHA-512:FB5A73B6134F991FC2E5D9A82B747C821074BEF86A7651638FC0127BEEF78B817811BB00417168BB937F968D55D8356AC0D19C2B569A6B9B31A10531683466CF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...D..e...........!......................... .......................................v....@.............................D....0..(....@..0v..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...0v...@...x..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.573738261423414
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CT63FOxCx7UjYN3tGGNyb8E9VF6IYinAM+oP93kDWvSpIYiF94yIj/AM+o/8E9V1:D3TUj+dGOEpYinAMxoCYi8/AMxkEq34
                                                                                                                                                                                                    MD5:D5D54965E6FB81875F2FCEA8F21515BA
                                                                                                                                                                                                    SHA1:87F22E6FA6D34CAA26CAF427D5F339880496EFE1
                                                                                                                                                                                                    SHA-256:759CC7CC96EA181926AF2F6B274CDB9BF63E329FC32A7A1C10B4CFDEE786F2A6
                                                                                                                                                                                                    SHA-512:308068EB57F007A4674BF5D90C9410BACC715E4AE537ADEC4CAF7F6837544D5526C676BEB2B1488090E7D9F4E966F030709C2934DE3A64E0A9059CE49D1F6A14
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... .......................................x....@.............................D....0..(....@..Xu..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xu...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sv.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.415346681858155
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CeC7xC7Ec3EINyb8E9VF6IYinAM+oP9Up1XIYiF9+kAAM+o/8E9VF0Nyu7:E7xCYc3EgEpYinAMxqOYioAMxkEG
                                                                                                                                                                                                    MD5:9C09AE8A870215FF9CF80F09D44F5610
                                                                                                                                                                                                    SHA1:2EE0328D7617A3D5A46C432DB2AE8BA2D335CB10
                                                                                                                                                                                                    SHA-256:49FDD7A5FA81697613F0495EA9E6025FFF84565184A1F3279CA42B166920F1E8
                                                                                                                                                                                                    SHA-512:7351B3955F0F881329DCD209841C84A05E0A2C2472FBF1B9F70505D4CE4A6A5FD612D45F3E11E917AB4D086E3B0C1CC7429238EC6DB6DBC879ECD9F3B8340B1F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!.........~............... ...........................................@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_sw.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.425300372554538
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:CL9FgicgiY7upr4M5aNyb8E9VF6IYinAM+oP91k+DrpIYiF96sAM+o/8E9VF0NyU:QFQ07Gr4M56EpYinAMxwYiJAMxkEUh
                                                                                                                                                                                                    MD5:1048D12C5DAA3492E2CC9060BC6AD9C4
                                                                                                                                                                                                    SHA1:50051ED23E19D842EB6C9162F537E7C20185ADE3
                                                                                                                                                                                                    SHA-256:9123A236243EC5508DB14A4E4E5B2BF3DCA077A6F6A85D24730D0A60A7B10518
                                                                                                                                                                                                    SHA-512:F9F6FF586A13CB32281234478A9F7CE2C6222EB94029EBC448815A5083E0303FC7CCA26F03E38575D449E81869817425F9AB2FF321D6A7EA5EE2EB0F99FB6C7F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...E..e...........!......................... ......................................<V....@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ta.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56640
                                                                                                                                                                                                    Entropy (8bit):5.625808123733913
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:KmHY51ZLm+4HwpEpYinAMxRBYinyxAMxkEqw:K27Hxb7+xmw
                                                                                                                                                                                                    MD5:795ACCE152FDF555FC5F0CBDC21BAC4A
                                                                                                                                                                                                    SHA1:B3A5F664D53813E69E33B4AEC327D8121E6066D9
                                                                                                                                                                                                    SHA-256:F22F4C4B011B9989D73F0EF16D85F9AA5471CC03394C99FC6D74C401ECA88700
                                                                                                                                                                                                    SHA-512:92638A7BD5962C44F3B21864FFBA114EF82B66334735D247B53ECC3A980C1208F597260547A2B9DA938C6D9D9BEF37AE94D5F6AF0683E0D551E6285D7FAE5769
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...}..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....}...@...~..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_te.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):56128
                                                                                                                                                                                                    Entropy (8bit):5.591538654163846
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:aVo3N5ya+LDQEpYinAMx7i+HCYi0GzCAMxkEX:aVo3Ip7HxI70LxD
                                                                                                                                                                                                    MD5:CB8793AEC04A19877FA3702EDA7C9416
                                                                                                                                                                                                    SHA1:7771A48AFE1B50C03BAE7D98090929753177C9DE
                                                                                                                                                                                                    SHA-256:FA58B434E5253B28091CE425EC9296E499241CFC24992E1592154FD1EC449819
                                                                                                                                                                                                    SHA-512:577EE217E15379E1523FA72FD995E450FE7DAD262E299B594CDC6A8455DCD5002454B84695BCB3B3370DFB03C0B540B931FFF2C43AC50311FB5E95CD9A76219F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!......................... ............................................@.............................D....0..(....@...z..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....z...@...|..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_th.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53568
                                                                                                                                                                                                    Entropy (8bit):5.6119616279583715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:TjlrGszNMfetNgEpYinAMxwKYi6AMxkEyI:TjlrGs+fetn7Hx774xWI
                                                                                                                                                                                                    MD5:36FF03BB1A029CF62E2FBC0112AB1E1C
                                                                                                                                                                                                    SHA1:C6BF4C0E47941019999722F1E57346498AF0A79A
                                                                                                                                                                                                    SHA-256:0F6B55613060D527AE41D5BCF5F34F50BD668BA57F9D4D2521EE7DAB2D053C02
                                                                                                                                                                                                    SHA-512:08AF745E330ABD384BF06468A2C1A7F6221B0A6C1A9452031FCB4076959C51EB912269EFF77E71F55BFB41C2BE1967A9373B224522ADF856E07B48593E68A92E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...F..e...........!.........z............... ............................................@.............................D....0..(....@...p..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....p...@...r..................@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_tr.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.448739449189127
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:Jip9ABk6qXQEdmvgh3FGk+G9Ahrx++BzQSX/EpYinAMxlDCYiZ+mAMxkEPo:JiZhdmvMFGkSxLQK47Hxg7Zxx0
                                                                                                                                                                                                    MD5:96C569C1FF875B897A2EBDDD3BCEE40B
                                                                                                                                                                                                    SHA1:44F8019C435ECBC1B00E8F1223ECE6C42F1E9976
                                                                                                                                                                                                    SHA-256:9682AF6D55EB930C650D69D7ECD4A6101681425F4821333C4513916AE57CC14D
                                                                                                                                                                                                    SHA-512:4E6521B28184AB8D09D45FD30E96F3703ADE7F495211380DB0BA79F0372CD834861165B9D66D8CDD0A036850C9866203A6EE60642B80DB4F89D7037BA56C8BC2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................$.....@.............................D....0..(....@...u..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....u...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_uk.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54592
                                                                                                                                                                                                    Entropy (8bit):5.574026643245629
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:QxZMuKgHWyC2EeovVHE/GfuQNyb8E9VF6IYinAM+oP9+Z9BIYiF90+1AM+o/8E92:UMu2uoEpYinAMxkWYixAMxkEw
                                                                                                                                                                                                    MD5:BB5F78643FDFBB3600ABB2D4529D857B
                                                                                                                                                                                                    SHA1:95F987F0237584B8428470EF8A34774CB18E83DE
                                                                                                                                                                                                    SHA-256:2D701243EFCC415F101A68D9A80BD1F93718DF906C5A9DF94B7C7210A72EEFA4
                                                                                                                                                                                                    SHA-512:98A80DC74B3A7FAA06401299E2260D6E5801F30C0066F6F4F3BE0B66D432E36FB72044038B839019B0EC37FB8B7317046DD69E74F2E97A7C3CA1DB277891345F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........~............... ......................................@.....@.............................D....0..(....@.. t..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc... t...@...v..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_ur.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.583323336112305
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:avoo+OmAcoWACeesYQEpYinAMxYn/YiGAMxkEj:am7HxG70x3
                                                                                                                                                                                                    MD5:0E98103A45EBECEDAE05F0EB6BB4AE6B
                                                                                                                                                                                                    SHA1:4FD5E0061553B702FC058A1052B6A0CE58F470D7
                                                                                                                                                                                                    SHA-256:B5931F32C31EFFB7FC90F95CD27481DB36B6BDB31FBB982CA787794D7E51F892
                                                                                                                                                                                                    SHA-512:DC37D909B89017BB2395D8C809D65427AE8C485075FD4D725D3A9BB636A43E0540DA712026CED6BD59BD634743C3A10471D2D7FBBAAF962BAFFFB52DE7F845D6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...G..e...........!.........|............... .......................................'....@.............................D....0..(....@...s..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....s...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_vi.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):54080
                                                                                                                                                                                                    Entropy (8bit):5.499322127248548
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:ZF7ysKFjncHNyb8E9VF6IYinAM+oP983nX18hIYiF9nX/qAM+o/8E9VF0NynU:LysKVcrEpYinAMxmnzYiKAMxkEG
                                                                                                                                                                                                    MD5:7A22F812F92B7F00EF38A14A70BE3F82
                                                                                                                                                                                                    SHA1:F1D265A2C835DCDD6225889E895EEDB7094943A2
                                                                                                                                                                                                    SHA-256:B3886AF3ABCF6880516189F822DB806524564AAB38F7F9C8AF9052F632BFEA0B
                                                                                                                                                                                                    SHA-512:4B82DDE7A1FBC563D7000A034AD943B7AC562CDC8757A70E1899FB418BB7EB3632A6E2BB8227F296DA503EAF16FA3398529CA7781AF606DFC31060E71CF999C5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........|............... ......................................x.....@.............................D....0..(....@..Xs..............@Q......$.......T...........................`...@............0...............................text...4........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc...Xs...@...t..................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-CN.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):48448
                                                                                                                                                                                                    Entropy (8bit):5.620247349904402
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:ZAURXZshAWB8Nyb8E9VF6IYinAM+oP9QNA9BPxo0IYiF9YU2AM+o/8E9VF0NyZg:HEAWBcEpYinAMxQYi6AMxkEk
                                                                                                                                                                                                    MD5:66B5ABEC8E4B2CABF62B68BD265A48B9
                                                                                                                                                                                                    SHA1:5CA58A3B929FC41E617F4CD205317B86E5346642
                                                                                                                                                                                                    SHA-256:BBEADD3AF22684259C95C463660AF9C35BA150A00A823B419DF4C633BD1B53CD
                                                                                                                                                                                                    SHA-512:F6958C4D687040E17B9A85DC59F26FF2E4B9321D05165946C744F97AB6D29ACFDC8DC531C3B68A25BEFF13BB566D73DC6FD95DA0A292B24F013C0270A27B0137
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\goopdateres_zh-TW.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):48448
                                                                                                                                                                                                    Entropy (8bit):5.631167984677434
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:ZuHOldGBiuNyb8E9VF6IYinAM+oP9Hs4S4U7IYiF9cO/TqlAM+o/8E9VF0Nyq2:fg5EpYinAMxeEYiV/TqlAMxkE3
                                                                                                                                                                                                    MD5:7B02084502F62AB08E9F4DDEE91A3068
                                                                                                                                                                                                    SHA1:4588AC3DE96A3DE4E11E0DF0079C58D45208BD8C
                                                                                                                                                                                                    SHA-256:8F04BB3D46A4BC4EB58A250296F6B8C97CA37FAC73319D7C7BD8D89CE9AC098B
                                                                                                                                                                                                    SHA-512:131FC0928334771CFFEA4CB4AEDF7E993CFEA819E492033601F5025C31C900413E9E534B5982040147B2D4F3EDBB764D588E78EA217DB0CA8C34FA3550EEDD55
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B/.I#A.I#A.I#A..VE.L#A..Q@.J#A.I#@.O#A..VH.H#A..VA.H#A..V..H#A..VC.H#A.RichI#A.........................PE..L...H..e...........!.........f............... ............................................@.............................G....0..(....@...]...........l..@Q......$.......T...........................`...@............0...............................text...7........................... ..`.data...(.... ......................@....idata..f....0......................@..@.rsrc....]...@...^..................@..@.reloc..$............j..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):282432
                                                                                                                                                                                                    Entropy (8bit):6.580618907494474
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:eRGm4nC4FXoZGxrxAO0e8x5q9Sj/aazvo:eGm4nXFXoZ4qeK5hZo
                                                                                                                                                                                                    MD5:B5BDDAF2C405EE17FAF06640D0F27397
                                                                                                                                                                                                    SHA1:4FEAD2DC9C066B21C99ACF1646D63A457E5587D0
                                                                                                                                                                                                    SHA-256:94B5ADE4D93F125632A7C8DBF79F99DEA877C28C2F40A9CA47C3C660A822CE4F
                                                                                                                                                                                                    SHA-512:D620835B8A46E2F0363B2FD1D0A38D58E4BAAA32F1B2DA0F8B9AB8286E031A8B4CA9077C53F88881ED827488C104D1EE099074A2FB7E4A786E8D12901EB4D2BA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...=..e...........!.........................@...............................P......P.....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):359232
                                                                                                                                                                                                    Entropy (8bit):6.269305509202009
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:YgW2y+X80/lGibh/Y7+Vkm5RVsMwbQYohXbBW+15qqpj/aak:/LX8klGibhA7+VlRGbQYobt5/q
                                                                                                                                                                                                    MD5:7931008AC869E46D780872FDE1ED4328
                                                                                                                                                                                                    SHA1:37B92B318D5252DDC9CAD22BCC37378124BB92CA
                                                                                                                                                                                                    SHA-256:971C492072C6E6E6DDB0B8584059E9AF58F3B089DECB151FD860599E818AD1FD
                                                                                                                                                                                                    SHA-512:E1A69A6DBF917D336F93783CB60D4D8FE5D7A2A15B2C993AA27A63DD87CFCE235BB4C9D7EC46359BA65C9D610D6CB369EA3BE5058192410C93C36B73B585A579
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...B..e.........." .................D....................................................`..........................................\......4]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..>...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psmachine_arm64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):327488
                                                                                                                                                                                                    Entropy (8bit):6.0919814113297415
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:MeyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeRobT28r5RIf7Kj/aaLA:fyDB/IMlG2k5au6
                                                                                                                                                                                                    MD5:8A08A9BBC3817967911FAEBB23D3892B
                                                                                                                                                                                                    SHA1:41D7426E52AF9E489767A87BCB3B1D0D10992BE3
                                                                                                                                                                                                    SHA-256:DF412FE80FB7C2DDA4FC6067641D8A86C53A98C8E8AF2712D657AE8610AE7646
                                                                                                                                                                                                    SHA-512:F5C77E3DA56FD9C9171EA04B2F28D20EB1B62EA82AD0CCE371896AF592E7B6023FC478343A4481F1D73678425257AFCE8A8A591F724E90CCB57EB72CEAF0B8DE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...c..e.........." .........(.......q....................................... ............`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):282432
                                                                                                                                                                                                    Entropy (8bit):6.580127272835487
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:2RGmVviIKXox+xDvAOlXMx5qNSj/aazvVP:mGmVv3KXoxefX65hZl
                                                                                                                                                                                                    MD5:51529BD404AD6A93BACC2FAA88376CA9
                                                                                                                                                                                                    SHA1:1891AFC0ADAD2250EB4F36988651039BC975BC52
                                                                                                                                                                                                    SHA-256:ABAD43AD3E27D1E6C8611AE285AD1A7C96127DF36B98DC2FE5674B511B62421B
                                                                                                                                                                                                    SHA-512:D8F63D61B6BD040FE03A14AE5DBACE73B929E9781EC64A359BF2A832F564DF6D096F0231AB0F408B60C9A6FEA1BD00B15DC0B58152F718C36F3FFA48CF661652
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A..A..A...@..A...@}..A...@..A...@..A...@...A...@..A...@..A..Ap..A...@..A...@..A...A..A.`A..A...@..ARich..A........................PE..L...F..e...........!.........................@...............................P.......^....@.........................@X.......X...........h..............@Q... ..T)...G..T....................H.......H..@............@..|............................text............................... ..`.orpc...c....0....... .............. ..`.rdata...,...@......."..............@..@.data....2...p.......P..............@....rsrc....h.......j...j..............@..@.reloc..T)... ...*..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):359232
                                                                                                                                                                                                    Entropy (8bit):6.269345224951521
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:xgW2yufk0/lGibh/Y7+Vkm5RVsMwbQMohQbwfE15qArj/aa/:ObfkklGibhA7+VlRGbQMoJ25z/N
                                                                                                                                                                                                    MD5:0259892D2CB710C05CFFCA79F9686FA0
                                                                                                                                                                                                    SHA1:185CB66A76CD7B26AD2EAFFF6B1222A7B6C0F309
                                                                                                                                                                                                    SHA-256:843DFFA160083155BCC046EBD3C99FA035044156C203A7AE191C629CD83A0EF7
                                                                                                                                                                                                    SHA-512:F9A0A25C5D95584055E097593F42FCA04BB4A80BA48A5AC0D592C88273D90896AEB4C975DE72CCB93886209AFFF3F18D771CA7D948AF5BB03B277250D5ED1A97
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S..S..S..c!..S..c!...S...&..S...&..S...&...S..c!..S..c!..S..S...R..z&..S..z&..S..z&..S..S..S..z&..S..Rich.S..........PE..d...K..e.........." .................D....................................................`.........................................p\...... ]...........h.......%...*..@Q...........1..T....................3..(....2..8...............8............................text............................... ..`.orpc...$........................... ..`.rdata..&...........................@..@.data...LM.......(...\..............@....pdata...%.......&..................@..@_RDATA..............................@..@.rsrc....h.......j..................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\psuser_arm64.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):327488
                                                                                                                                                                                                    Entropy (8bit):6.091915599984797
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:0eyV9fNJmbkqhyVVVz6a+/hRy3LZkMyeHo+TAYr5RIf7Kj/aamO:3yDB/IMlpAw5au/
                                                                                                                                                                                                    MD5:8C35995DEDA169AF62A83A5F302C9EB1
                                                                                                                                                                                                    SHA1:A45BE3269442DFC9A4D89EFF0003E2292349C2CE
                                                                                                                                                                                                    SHA-256:0C5845A003CE6480B24712459725581839E36B00514DA26D4214853107E090D0
                                                                                                                                                                                                    SHA-512:2D660FB5CEE6C99E3A6AC54872D0F404E9F7A21B141FBCC067BE40EECDEAE29AC2D1E5141211CFB704EE70BDE40C4D5336E3538F0883143245B90BBBB82F63D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................."......."...n......................."......."...........E...;.......;.......;.Q.......9.....;.......Rich............PE..d...g..e.........." .........(.......q....................................... ......6.....`.........................................0....................h...p..H.......@Q..........p...T.......................(.......8............................................text.............................. ..`.orpc... ........................... ..`.rdata.. D.......F..................@..@.data...,K... ...(..................@....pdata..H....p......................@..@.rsrc....h.......j...0..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):175424
                                                                                                                                                                                                    Entropy (8bit):6.036513000632513
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:cQPidj5By4/EeaZL8Z0BFri9WSfWJVVqH9B+bCe5kNtupnu0D6EDpf34fdjdEcRh:heaCSgfuqdB+i48
                                                                                                                                                                                                    MD5:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    SHA1:184A42476F12A89731F608C7198E47BFC35A8364
                                                                                                                                                                                                    SHA-256:633B554A26AD05C06DFE33A50F6D69E9160207F3168E15FFD3CB5652B1E8E9D4
                                                                                                                                                                                                    SHA-512:DDB593D8A6BC515DCA7A4EADB2F50C28C8E61E9A829186BE9B9E8B19371E969FE055104DEFFD8CD5CD9B48F2468EC8B3D7BF6AEE45079E445D3FE42696E2D5A2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....A...A...Ao..@...Ao..@2..Ao..@...A..@...A..@...A..@...Ao..@...A...A...Av..@...Av..A...A...A...Av..@...ARich...A........PE..L...)..e.................<...(.......z.......P....@.................................A.....@.................................`q..x.......0............\..@Q...... ....^..T...................@_......X^..@............p..\............................text...4;.......<.................. ..`.data........P.......@..............@....idata..P....p.......J..............@..@.rsrc...0............T..............@..@.reloc.. ............J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\122.1.63.174\brave_installer-x64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):124775448
                                                                                                                                                                                                    Entropy (8bit):7.999996586829686
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                                    MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                                    SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                                    SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                                    SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\CR_DA195.tmp\CHROME.PACKED.7Z

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe
                                                                                                                                                                                                    File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):123339642
                                                                                                                                                                                                    Entropy (8bit):7.999998598936994
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:3145728:c7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBaE:cdzjD7s9FlgsRL9Vo/uE
                                                                                                                                                                                                    MD5:86EFBF7DFA2540421459D8F126B69DFF
                                                                                                                                                                                                    SHA1:B2F977F8D49B4B52B9194A21995A72671F428DB0
                                                                                                                                                                                                    SHA-256:3CF48645EAE5008E76B836860C0E97BA396393ABB3BF169272A3740644291EA3
                                                                                                                                                                                                    SHA-512:1940ED706A6B88C7769B365665DD5DC9405CAD87A9E52A88F85C8F20B41C20453836146D2981DAC547B34B0F66E223161463B14612EA3EECE50BF0D50DB98511
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:7z..'.....%...Z.............,0........8%D...o\3.3A.....B.h4......jh.-.}...XJ...u.../..sA...!k"... D.[p.....'.PV|S.F=..X.1...........?.....].+.xu%3.j..B..r.U.....F..Y.V..D..c!.-/0..x/.........X...d..z.b..$k..Fk.....VU.........l.c...c`\.....*6R.R.W`...nb.hK...(.}.YX...3.Vg. ..P....1.<....9O.?H.ma..H..x...P.>......Ce.....o^F.OE+..\hrc..J%".76..C.3...F0.|..7....4....$fw.j..r..xP....+5.Wi.F..?...rSg.A.L.....X...."...:....X....Vd.....YDvabU;..Y.[f...8...U...g...v..w".Qz..(.u8Z....M.N../..5.C*.7....Y.....:.....hv+...N.4.:....D7..s..S..#....<`u..v..x.S...o..N..r. .C.,E..G....w.qP..Yc....:...o'-h.)....%...H..U......}..1...-$\......../S....~4#..<C...^....9.h.>-Y.......3e-.......38.+`F....Ao...)..y.m.<....l.-..'6=vq.wC.. h9.`......s...V.........J.1g^J.n~......7w...<....a..../..7f..;.-..K.......NQ.......c.[.~.PI......V.A.v.f.@..x..|.1...............n..\...n.Wq9f....3.E....D.*...|..._.H$.df._....J.l;1..;..v9.z......8.Az.J.`.?.u.Z7.S\,}3A9\.Ai..` .

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\CR_DA195.tmp\SETUP.EX_

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe
                                                                                                                                                                                                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 1398528 bytes, 1 file, at 0x2c "setup.exe", number 1, 106 datablocks, 0x1 compression
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1398528
                                                                                                                                                                                                    Entropy (8bit):7.997895296558124
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:24576:Ya8jjP9IJP9Z/SYOSvOI5cWYXQ8GRax5zy3x51HKibc6ipXEnbsZg+SzDE:Ypjr9IJl8cOUc3Q8/zyh5JKib/osbsZL
                                                                                                                                                                                                    MD5:4779AEF1A790DC6877982099B73D0830
                                                                                                                                                                                                    SHA1:84F3CC4D75FDFA339094C09CC3AAA084B1C58447
                                                                                                                                                                                                    SHA-256:2C528B0F11BFE7788F8A95091B9C4E624B4A22173FE1F94DDDBF49B190100C9C
                                                                                                                                                                                                    SHA-512:EC6F7287EE608EF832F8AEB331584FC3C6DF0C9D257DD324485DD6FE4274F9AB5129181787535D890584D5EAA38741A1E64F4E0DA52098D957185A37A2386B9E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MSCF.....W......,...................F...j.....4.......mX,C..setup.exe.....j...CK.].P.W..!.N..7X..q..l.u..-w...u.......I....V*.4..;......J...n....ck/u.....s...b..h~h..u........}..u.o..F...~..u.{....y...~.%.m.L.$.........e.y/C.y..Gw.J.=Z....V]...q...vy<Z.m..[.F...cs,..m.V.f.,I..$.rK.d......+.w...2$i.]..=....$......4IJ.D..%....?...J.m..]..>..\.i.7`_O......T.|B.&..o-..!....T..$.o.r....W..J......vM.._o.k.yuk6.a....."...A.y5..:.$)Wqr......#.C....e.....;.'I_..{.....r...4...y.....E.9...y..}._}"...5u.n..*h...I.E^....x..qp..=.....u.Z.. [......ZTZ..Z>.\....%..EE..L*.2...vW.....P.VP.....S...w......PA.~.gq....Y.<...%..{_\..>.s..&}....D_.Si....g..K......l%[..+.+...m........`R.6[e..NQ..O...O%.y....CIY.([Y]nWV/.C!..LC.lSY.y....U..Ue.S...S..'g)..7._......{...l.hSY...I.l./.B..M..B.A...D.W!...2...).B2.O2..2......E..des.-Q"j.Q#..#B.uG.Q.'uy..<...{Yc.....z...0.........X..D.l........D.N...N\......H...#..=....i....8~...'@..;...;..]a.. A...D...3HL..,p....|.....

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\CR_DA195.tmp\setup.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3458072
                                                                                                                                                                                                    Entropy (8bit):6.570710999931397
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:49152:6rExC6sQI1X3DuLCyJ6kLi7XssLIkmMgtfhXbcszPMuX:Z6ke7csgP
                                                                                                                                                                                                    MD5:41F40C4225A40DC6DA684E5F40CAABF2
                                                                                                                                                                                                    SHA1:25F509B439071AABBFADB37D74FF20D8FAE5AC32
                                                                                                                                                                                                    SHA-256:0AF286D49A182A01201C6AFC9154520D85499301DB2172C47FEF7FDAD6EF7514
                                                                                                                                                                                                    SHA-512:5810B523F14FE12EF0A62F580D0CDA7326175585D31052A8A666FB1FD31D490249ECB5E65A388DE5C813BC90BF2A9EA40DAE0C337291FFA0F62F55DA216E1E4B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e..........".......(.........p..........@..............................6.....9s5...`.........................................#.,.N...q.,.|....@1......`/.......4..(....5.T%..|u,.....................Pt,.(...P.(.@.............,.......,.@....................text....(.......(................. ..`.rdata..H.....(.......(.............@..@.data.........-......|-.............@....pdata.......`/......r..............@..@.gxfg...`1....0..2..../.............@..@.retplne......0......./..................rodata.......0......./............. ..`.tls..........0......./.............@...CPADinfo8.....0......./.............@...LZMADEC.......1......./............. ..`_RDATA..\.... 1......./.............@..@malloc_h.....01......./............. ..`.rsrc........@1......./.............@..@.reloc..T%....5..&...v4.............@..B........................................................

                                                                                                                                                                                                    C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):124775448
                                                                                                                                                                                                    Entropy (8bit):7.999996586829686
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                                    MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                                    SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                                    SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                                    SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                                                    Entropy (8bit):1.3579759161591185
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
                                                                                                                                                                                                    MD5:679AA20E51F27B4EB6E189FA1933756C
                                                                                                                                                                                                    SHA1:A8E7330C146066403A7123E11DF480918BE365B9
                                                                                                                                                                                                    SHA-256:A955139897F76482378C145A5A42AF4A76B5E6CB8CEE8340ECF69EC04B845AB6
                                                                                                                                                                                                    SHA-512:A6482BAA92265A99C431FC507F0FE282E6D8C93477990C137EA1F1A99988D7C1C3EC8904EA6FA6C5401D6DEFA29691330BBA23111FA9F9A7BF6343636DD9CB38
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0xdb22d45e, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                                                    Entropy (8bit):0.4221640654507078
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
                                                                                                                                                                                                    MD5:CB28C5B04EE2AEA67BB78A10B79E88FA
                                                                                                                                                                                                    SHA1:8C9170336539C5A6EAA1EBCF1C86D0FD80E3986B
                                                                                                                                                                                                    SHA-256:32C2E7629B237B4EF3E1ACEDCEF8C378CA821F3F096C55EDD10D5D534D36B211
                                                                                                                                                                                                    SHA-512:4EC1B7065FBBDC5641B830AB5B650BD337D9C47D234448FB44C68BF7851172C5BE362DE93351BF14A9AC9BC825BCBB0059E9005D9A2D31CE3B6BD7E0E3CB53A6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.".^... .......A.......X\...;...{......................0.!..........{A......|o.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...........................................|o.................3d.......|o..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):0.0761665269599397
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:eYeL+ajn13a/5l8y08llcVO/lnlZMxZNQl:ezLx53q5jfOewk
                                                                                                                                                                                                    MD5:237B1534F8884A4366CB1B1C643F05DA
                                                                                                                                                                                                    SHA1:6E3A21854761E8AB06085B9F602CBC8651040D23
                                                                                                                                                                                                    SHA-256:3DF28E899A72CE3AE57ACDB79AA0EA237141FF4D1179D11A4AEE2C3F5F3CA30C
                                                                                                                                                                                                    SHA-512:CAD02B48D06088776212172D176FB7E0EB35B14376878DF74412E7F87E725C023C3598DEEC13292A8F04EFCC20C300F48B44BC6AA562D19B5E7A45ECF2C6E1B6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.'O......................................;...{.......|o......{A..............{A......{A..........{A]................3d.......|o.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\ZCZT871J\www.msn[1].xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):126
                                                                                                                                                                                                    Entropy (8bit):4.958763705855897
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:D9yRtFwsSxzqC+eAsEVStKVHFk6ISXRMIAqTVicQbZKaKb:JUF+FqCqRStMTBMmOZub
                                                                                                                                                                                                    MD5:66AF845130995702EAAFBFBAD3E62839
                                                                                                                                                                                                    SHA1:FFB3E21E40431BF2BBAD27E4B830746A5EAE4C70
                                                                                                                                                                                                    SHA-256:F9BD35CF940A3BFAC8A36912184899C4C33D4EBF093DC9FA8EF587F8A6603D3A
                                                                                                                                                                                                    SHA-512:6DF0154BF4B8E64EBBF863264ABEB87A94B2E65F1BC3CFB6B8507563834C6CF8D2A0159DDDCD308B7A65D928340B71FD885FD007A5C4348845F659A5A65C97B9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<root><item name="pageVersions" value="{&quot;hp&quot;:&quot;20240308.207&quot;}" ltime="882319296" htime="31094249" /></root>

                                                                                                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):3.8046022951415335
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                                                                                                                                    MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                                                                                                                                    SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                                                                                                                                    SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                                                                                                                                    SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0662761c-2bc7-4c83-8512-0888244e1ee4.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):26021
                                                                                                                                                                                                    Entropy (8bit):6.069517720551094
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUXUkMDyNeMQWonubZpG2k:qFmi3bXYUwBZpBk
                                                                                                                                                                                                    MD5:4D9EBC4A0529CBB4629DC2735001212B
                                                                                                                                                                                                    SHA1:990C04B50AE61713E22C86F23DC991BF2665A06E
                                                                                                                                                                                                    SHA-256:568DF5390E8F6DA3043D7ACA32514440980CE83B74BE3D0D7D48F508E85D34CF
                                                                                                                                                                                                    SHA-512:283A20E3C4486784B90B7C9D9F295AFF392D41E1A71260C68B2A2254D7E42890E69C9D43044D5CDFC42DF3311A37394D66E6306F718B58E4574CA00F3CD84A0B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\10abd3f1-ef55-4e61-bda2-1a922dfd6d40.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):27140
                                                                                                                                                                                                    Entropy (8bit):6.072334888283395
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUXU5/6DyxXeMQWonubZpG2k:qFmi3bXYcOwBZpBk
                                                                                                                                                                                                    MD5:8716FF45417E1F6068E0A447B6EE5C79
                                                                                                                                                                                                    SHA1:9785C14342A1F8D74EBAD0D6765F92C83506037D
                                                                                                                                                                                                    SHA-256:0C71BCD75A70F7C4FB65CDF6B3CF1F8359DAEC76BD4A1C5247BC437EB52B2666
                                                                                                                                                                                                    SHA-512:E2E31EF12597D81AFA5D04941D4CB2E13AD7003F6E41AEA4BAC90433B4E4DC108B76A6868B95BAB2AF735060CF5B937033C4FF3051B2E27C79098DFC6E2BF5F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\12b8e177-c35d-44e7-b621-84f279da8b62.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):27140
                                                                                                                                                                                                    Entropy (8bit):6.072334888283395
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUXU5/6DyxXeMQWonubZpG2k:qFmi3bXYcOwBZpBk
                                                                                                                                                                                                    MD5:8716FF45417E1F6068E0A447B6EE5C79
                                                                                                                                                                                                    SHA1:9785C14342A1F8D74EBAD0D6765F92C83506037D
                                                                                                                                                                                                    SHA-256:0C71BCD75A70F7C4FB65CDF6B3CF1F8359DAEC76BD4A1C5247BC437EB52B2666
                                                                                                                                                                                                    SHA-512:E2E31EF12597D81AFA5D04941D4CB2E13AD7003F6E41AEA4BAC90433B4E4DC108B76A6868B95BAB2AF735060CF5B937033C4FF3051B2E27C79098DFC6E2BF5F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\40ee59fb-b15e-4b68-a544-25ec6b459884.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4ea675ff-db6f-47f1-a696-ced428e85bf8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7690
                                                                                                                                                                                                    Entropy (8bit):5.583638969589826
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:o44qsNk/b8fKz5ih/cIyURLl8Roto+yQByUVvl63ZQke4WJkDycH+TUbaMjVxuL7:o8sNw/UViRUsU0JQNkDyW+VMOku
                                                                                                                                                                                                    MD5:51649B0D0C8042CA8A85F23AA70E2A3B
                                                                                                                                                                                                    SHA1:AF034681BD079DBF13BB34B2311886DA938B300F
                                                                                                                                                                                                    SHA-256:0D6C95056AB8689E8939EF47FFA5AB7D64D083DBE6483E52A7A1D9947A5889D8
                                                                                                                                                                                                    SHA-512:61FFAC32B00379863C0B15EF5CBF71E81921D4A40550F5ABD196700F8B0F157F9D8CF945347EBD6F09035D7CD7F331BC21FBEB24734FE4FFDA8AEDCFE63E9FF9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered"

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7552e0cd-ab93-40f2-9d38-579ce8dafadb.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):62635
                                                                                                                                                                                                    Entropy (8bit):6.081059230805637
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUBUZBHwqckyFhzq2pLf1wf/ay3CtSoyVrLdrWXz7N3TgAz3Jei:qFmi3bXYfzkmprMn/d8zR3cAzwwBZpBD
                                                                                                                                                                                                    MD5:895A5C314451670D04491E5C32B2BED9
                                                                                                                                                                                                    SHA1:AA4BA61E6A1143C78CAEEDEFBC047B0E3653E593
                                                                                                                                                                                                    SHA-256:95B24206873C36AFDA71B5E3E76E27B08F476305AF1872AEFF6ADA0778E0A79B
                                                                                                                                                                                                    SHA-512:D932ABCA26A2DA4E1909721BD2BFC1B92CA9070329EE8C63E130DC65CECA7A2F5B6071625D7482AE3C8B98BE899933AE25F9C569205759AD84F0906B10D8B4D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\11bb7342-8192-4842-9d3f-6a8ea781f57e.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):101961
                                                                                                                                                                                                    Entropy (8bit):4.633247394116942
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:W/lv4EskMNTQps5Vdw34PsiaM++tDulXridW+LuhVrL:+wRQO5VdwIT+S8GdZKVrL
                                                                                                                                                                                                    MD5:8D94C8CCF0C8BCEC6BB57C7A35780F9A
                                                                                                                                                                                                    SHA1:9BAE04B1199BE76C68B6C0092431C006A9D0B2EE
                                                                                                                                                                                                    SHA-256:3C65E92F6827627CE1AEC0B03BDA3853E5130D6D4A606A295ECC03724B321359
                                                                                                                                                                                                    SHA-512:1BEDB6D3588E7ECB118FC79D5CDDD454B044250F6FD7F5F56330D0B24FBBCFB712FFA3F1BA6A3B62E8B8157A32CC2F5483C3CF3EB88766877711E445B5CBB8DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):101961
                                                                                                                                                                                                    Entropy (8bit):4.633247394116942
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:W/lv4EskMNTQps5Vdw34PsiaM++tDulXridW+LuhVrL:+wRQO5VdwIT+S8GdZKVrL
                                                                                                                                                                                                    MD5:8D94C8CCF0C8BCEC6BB57C7A35780F9A
                                                                                                                                                                                                    SHA1:9BAE04B1199BE76C68B6C0092431C006A9D0B2EE
                                                                                                                                                                                                    SHA-256:3C65E92F6827627CE1AEC0B03BDA3853E5130D6D4A606A295ECC03724B321359
                                                                                                                                                                                                    SHA-512:1BEDB6D3588E7ECB118FC79D5CDDD454B044250F6FD7F5F56330D0B24FBBCFB712FFA3F1BA6A3B62E8B8157A32CC2F5483C3CF3EB88766877711E445B5CBB8DB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                                                    MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                                                    SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                                                    SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                                                    SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                                                    MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                                                    SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                                                    SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                                                    SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65F2B47D-1DE0.pma

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                                                    Entropy (8bit):0.3564493930563471
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:Eb680xHaplUN8MvqI+unHZI3lq3QkNH9OhSPX40VnqoJO1HuX6WfRXQzHcc5TtfT:TASHSaQe9OzPHhLAaHcXEmPso
                                                                                                                                                                                                    MD5:535F1126622A45D7B6C4C25935A19620
                                                                                                                                                                                                    SHA1:DCE317B8EC6AE8113529C53A58F05A5C2A5F783D
                                                                                                                                                                                                    SHA-256:08231F9356D9A28BCD41379D5B95A4D12BA643AC0FAC3D143A10D407BABD52F5
                                                                                                                                                                                                    SHA-512:E540631B22387142E4C599D741CB448E44AD0B0A957B433EB5430FC1C343A03DA4E844E0BD5E8241702A080B3DC729C608DADAD7B1AEB16D5E82A18FF0830E65
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".ypbhil20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...b.J.^o..J...#...^o..J....k..^o..J..?....^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J....%.^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J.......^o..J...'x#.^o..J......^o..J....\.^o.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65F2B496-20EC.pma

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                                                    Entropy (8bit):0.040779200480038615
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Yd0EbtmqvDtKX7SJEa3XxxTxqZ/g+X1T970R6EqhTS7NonUK1gQLPAk/n8y08Tcp:O0EtFeK8YGRFhIsZgmAk/08T2RGOD
                                                                                                                                                                                                    MD5:56C5CE7A69B2D7CF2BE4FDC984F8BAE2
                                                                                                                                                                                                    SHA1:1562ACD8DBCF278AB56EFF3840CC2FDC2DD7BE08
                                                                                                                                                                                                    SHA-256:0A8079D94E41288B1AF974F1CD1BFAB1757069ACF79E32E9E0A7B8D14B559CAD
                                                                                                                                                                                                    SHA-512:5FA77084731A04773C4155C126CC084E8BFC5462CA93F5ED58F49B1087936A93FA3466D338CC1312EC8EF10F397A6C33F61735D51D46B31B8609A143255418D7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...@..@...@.....C.].....@................b...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".ypbhil20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):0.3553968406659012
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
                                                                                                                                                                                                    MD5:CFAB81B800EDABACBF6CB61AA78D5258
                                                                                                                                                                                                    SHA1:2730D4DA1BE7238D701DC84EB708A064B8D1CF27
                                                                                                                                                                                                    SHA-256:452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
                                                                                                                                                                                                    SHA-512:EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):280
                                                                                                                                                                                                    Entropy (8bit):3.060980776278344
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1jtll:o1//BVsJDG2Yq
                                                                                                                                                                                                    MD5:E52B480F0230D08C00F610FE45C6B1B0
                                                                                                                                                                                                    SHA1:9D3920941C023DE18FE367B58C02F02635EF9426
                                                                                                                                                                                                    SHA-256:000C5B73C330D02E177010D59D638BE64378163C800D1D94F6467C5FAF983F4B
                                                                                                                                                                                                    SHA-512:4CB8326C6D2150EA5D48B9E131FD3DF08DF01AF9FC2A6B46C62ECA1BFBC903E052BFF8DF7D4C5ECEB276C4D1DA28B1E784096AB0B7F1228C1E6F5599D29054DC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1bc28f4b-51f4-450f-ae68-8a1312a4e66f.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9222
                                                                                                                                                                                                    Entropy (8bit):5.186781229036386
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:sVnnJZovler/Lthx5YnsYPpj+FVAzN+FBf:sVnnJZoNwt7mpUVWNW
                                                                                                                                                                                                    MD5:8E80E7C2CD5524C181F6092BEDD25D5B
                                                                                                                                                                                                    SHA1:9D7F4EEA0C266E55BD57B0EF3963F383CDF5AFBD
                                                                                                                                                                                                    SHA-256:6593453468ADC5CB81A682F84BB4837763C37799E0504E422906313AC65FD08B
                                                                                                                                                                                                    SHA-512:F23D27368A5DFF8B4EB38A9278F9307A4A08648B931059F084924657649A95E7702FFF4630543C6ABB2F21CF2575A6ADE1743802F4032EF2938E7A2C0B5C8C94
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2d12adce-7aaa-4a8b-a68a-f4c0a79370ac.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7726
                                                                                                                                                                                                    Entropy (8bit):4.912929779644774
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sVrjql4J1Pb9JwbvlNYnedY5Th6Cp9/x+6M8muecmAeCYe4zvrN+2X6gS5AtEHb:sVPnJZovlNYnAYPpj+FVAON+FJf
                                                                                                                                                                                                    MD5:9C7A64B63AC4AD7702EAB4F658C62286
                                                                                                                                                                                                    SHA1:ACDD22B75F399BC7927ACFD0B52E81F904CE6E62
                                                                                                                                                                                                    SHA-256:CEA34C5B3D895994DEA11A8F6E52288D3A974887C389F7F634DD3376908DACFF
                                                                                                                                                                                                    SHA-512:ED17F719371FBB8698D6301F1817135F6CA7A43EF71E2CA14EAB5B8E7D7DC2A58408CD0F0B9B76A054E2ADB0E242FFC9162798B387054BD16C4706F8A697158F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2dac8615-e983-4ff0-b510-4387d109266e.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8567
                                                                                                                                                                                                    Entropy (8bit):5.072357017241135
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sVrLql4J1Pb9JwbvleXb/LFyzYnsY5Th6Cp9/x+6M8muecmAeCYe4zvrN+2X6gEf:sVnnJZovler/LuYnsYPpj+FVAON+FBf
                                                                                                                                                                                                    MD5:C4CFBEE2BD1919D8D919E66E98763249
                                                                                                                                                                                                    SHA1:6165E16F4BC6FB12A9ED897594022E274216E9CD
                                                                                                                                                                                                    SHA-256:55D1FD3397F085A04C6957CD0949CA2231233E6AFF10B667C23366AEA6B2B811
                                                                                                                                                                                                    SHA-512:3DD870A11B0A1F4E10D1C1733A6B7250746C1D769B7A4F0FF281F2D1F49FC848481D78E470ED08F68014727E3B494140C693CD020F4968F39C7201B38FEC5CF4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3c09246b-01a7-4c4b-852e-e68ca7192b06.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25012
                                                                                                                                                                                                    Entropy (8bit):5.566931743099954
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:vTkZFDWPAmf/y8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0NuQjrw0pdtui:vTkZFDWPAmf/yu1jalIQYKt1
                                                                                                                                                                                                    MD5:533609005784B64831C1B9297FC73EFD
                                                                                                                                                                                                    SHA1:F395F32CCD59FE7E7CA82D341B5A8C76ACFC11CE
                                                                                                                                                                                                    SHA-256:E82BA50C655C2163CF70779E035C22C8DC197A5C62EDC4FB8977A83B1D8B146F
                                                                                                                                                                                                    SHA-512:97BE09A151FB2E257C69666DC52FA166D73D13DD9EA97777A09635417E94A1DA439B3F76DC4BC394C12D777E2B665F4420C308A466C43EBEEF137E5E44884CDF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354878334243509","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354878334243509","location":5,"ma

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4196fdaa-c34d-4c88-8f35-f1c02bebe6fe.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:L:L
                                                                                                                                                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51d6fb00-4c95-49d5-a4e7-df2bc4f5a0ba.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9294
                                                                                                                                                                                                    Entropy (8bit):5.18643511723987
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:sVnnJZovler/Lthx5YnsYPpj+FVALN+FBf:sVnnJZoNwt7mpUV2NW
                                                                                                                                                                                                    MD5:9F62000E334CDB538EB1D907F7EAD9BB
                                                                                                                                                                                                    SHA1:5BD52854F8832EC8D74146ADD8C16DE3D3FDE08F
                                                                                                                                                                                                    SHA-256:15652935E9B0707226293978C24AE70B31C58ECF60EBB9E684F1A88D126B3BC5
                                                                                                                                                                                                    SHA-512:B6387DF8DBB78035BD506AAA004A909EDCFB8CC9DD6B5707926585D2024E55FD21A79A982EB3595F48CC2785664C2A56B1F7C2AA556AD790D23A1C593F943067
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\679fb908-6811-4a07-9dc4-8cf528e3b70e.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):30096
                                                                                                                                                                                                    Entropy (8bit):5.566576639814981
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:vTkZDDLoLqiDWPAmf4y8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsQnNuQjrwlpdtuD:vTkZDXWqiDWPAmf4yu1ja5QnIQY5t8
                                                                                                                                                                                                    MD5:45D692383BB7519D9894CFCA6969062E
                                                                                                                                                                                                    SHA1:368FBAC77FF26AC08D1321FED02413ACA7D8C6E4
                                                                                                                                                                                                    SHA-256:5C9F82A9CDD8452E5A5F0415875781AFE47D804E6D98A0D606F7F75D4F64D647
                                                                                                                                                                                                    SHA-512:A951AE1F35278A5253008287E667AE72A24940EB8DE3F78D5A0FD46D0F4E6ED4494642F325281CEBEB9D6A593AC11250CD4778BBE7B50F28CACDEC66CB3277E4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354878334243509","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354878334243509","location":5,"ma

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):12735
                                                                                                                                                                                                    Entropy (8bit):5.349768374088969
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:N1OEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:nOEOKSXs/J7mGnQmLu5/5eNdl
                                                                                                                                                                                                    MD5:D12A030CB1368B775DD3DDE9035C2C40
                                                                                                                                                                                                    SHA1:FD7396E970279F8637183DB32419A2C47981406A
                                                                                                                                                                                                    SHA-256:D02ADF6B18AE0FB93E54C0099B304C1CA9011E82A87A09971E29EA18927B60C1
                                                                                                                                                                                                    SHA-512:AB2575F23D99A09CF937DA1116E2FDDB5395EE6D43F92D0CD740F9157FEC5E1E16D856523DB8658C7742BB211DAC98B5E8BBF8C0B07327DC72B6033A98895B0C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13354878346379750.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=imsWdc2PGC%2BuAreb04yW9xpieA0z5NEov%2BfbkBLqCb8%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-05-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBAT

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):293
                                                                                                                                                                                                    Entropy (8bit):5.109121261795683
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqRmzM1wkn23oH+Tcwt9Eh1ZB2KLlvqsmtrN4q2Pwkn23oH+Tcwt9Eh1tIFUv:S2rfYeb9Eh1ZFLgtrOvYfYeb9Eh16FUv
                                                                                                                                                                                                    MD5:CDC4DF210D77BDEDEAB8E5DD12804D60
                                                                                                                                                                                                    SHA1:76D1AFEAFFFCE0132AA63CF0CBC62DDF10F9A5A1
                                                                                                                                                                                                    SHA-256:39AB743C01DD79944C4653A2EEA76C1B7DDD0ABFC6E38B2008238F1BE79AD89A
                                                                                                                                                                                                    SHA-512:8D34BBDA868B7163623898EEAAF430131C45FDD05731E3E6B7BA0E97D19C9BD8CE1AAF96536525C0C1E29F886EAAABAE4556303ACDDCC8F058A107B0355AA57D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:42.503 2194 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/03/14-09:25:45.652 2194 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                                    Entropy (8bit):0.3202460253800455
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
                                                                                                                                                                                                    MD5:40B18EC43DB334E7B3F6295C7626F28D
                                                                                                                                                                                                    SHA1:0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
                                                                                                                                                                                                    SHA-256:85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
                                                                                                                                                                                                    SHA-512:8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsFl:/F
                                                                                                                                                                                                    MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                    SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                    SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                    SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                                                    Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                    MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                    SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                    SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                    SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                    MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                    SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                    SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                    SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                    MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                    SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                    SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                    SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):262512
                                                                                                                                                                                                    Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LsNlFHull:Ls3Jql
                                                                                                                                                                                                    MD5:27D5584BBDCDCCB1041A1715698C845B
                                                                                                                                                                                                    SHA1:32A93926938708DDE6DCDB18D42002E7C912A465
                                                                                                                                                                                                    SHA-256:3817884E3E1147EEA008053C182A3AEBF58487EDAC856D465712CC4E799D526C
                                                                                                                                                                                                    SHA-512:567636FDE20D00B29050F552B518814468797D1968424424385A4FE5FA9369C2D70FFADC6D3BE6526F74B2B67527B9E53301D277A903348CFAB14F32036AEBA7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..........................................'.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33
                                                                                                                                                                                                    Entropy (8bit):3.5394429593752084
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:iWstvhYNrkUn:iptAd
                                                                                                                                                                                                    MD5:F27314DD366903BBC6141EAE524B0FDE
                                                                                                                                                                                                    SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                                                                                                                                                                    SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                                                                                                                                                                    SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...m.................DB_VERSION.1

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):305
                                                                                                                                                                                                    Entropy (8bit):5.187713891455486
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqF1wkn23oH+TcwtnG2tbB2KLlvqbZ+q2Pwkn23oH+TcwtnG2tMsIFUv:lfYebn9VFL6Z+vYfYebn9GFUv
                                                                                                                                                                                                    MD5:D08664A612C53FE982A4B418619187C5
                                                                                                                                                                                                    SHA1:D723F7B99EA33480AAC53330B7CC0707E631EBF3
                                                                                                                                                                                                    SHA-256:52EE340FECD3C1D3ECAF0EE2D0D68BA58CAC20494B1C5723C9DAD08F73365ACB
                                                                                                                                                                                                    SHA-512:ECD3263583CF738B3DF7FE70771913927AB7B97B35969F996ED20A447E4960A705B70286AF2368E0BE85C8273CF6C3FC1123AB7D85E01FC2F3E92D4B8F0114E5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.249 1e9c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/03/14-09:25:34.294 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                                                    Entropy (8bit):0.494709561094235
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
                                                                                                                                                                                                    MD5:CF7760533536E2AF66EA68BC3561B74D
                                                                                                                                                                                                    SHA1:E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
                                                                                                                                                                                                    SHA-256:E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
                                                                                                                                                                                                    SHA-512:38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                                    Entropy (8bit):0.5094712832659277
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
                                                                                                                                                                                                    MD5:D4971855DD087E30FC14DF1535B556B9
                                                                                                                                                                                                    SHA1:9E00DEFC7E54C75163273184837B9D0263AA528C
                                                                                                                                                                                                    SHA-256:EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
                                                                                                                                                                                                    SHA-512:ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):209
                                                                                                                                                                                                    Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                                                                                                                                    MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                                                                                                                                    SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                                                                                                                                    SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                                                                                                                                    SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):281
                                                                                                                                                                                                    Entropy (8bit):5.1571050412241695
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:Fqbe+q1wkn23oH+Tcwt8aVdg2KLlvq0Sq2Pwkn23oH+Tcwt8aPrqIFUv:yeyfYeb0L3SvYfYebL3FUv
                                                                                                                                                                                                    MD5:AA4182F017A0439695C1A564F70342BD
                                                                                                                                                                                                    SHA1:95CFADE4D8E3C1D16495CFFB45F21B1F91493D86
                                                                                                                                                                                                    SHA-256:4A4FAAF8B241F4DC5E677C93926F495F766B9123BD8BDA0CC6D6BD49C84F76F1
                                                                                                                                                                                                    SHA-512:88722E87C3EBD8A3F07BCCACE607ADB2F55DCAFF52B176C8DA00E5A6C29411456A0E8178302E116D204BEBC785EFAF0DD9583A380D48592E98F6AA0236B0DBEE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.294 1e90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/03/14-09:25:34.621 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):209
                                                                                                                                                                                                    Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                                                                                                                                    MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                                                                                                                                    SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                                                                                                                                    SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                                                                                                                                    SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):285
                                                                                                                                                                                                    Entropy (8bit):5.161618391597908
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:Fqjq1wkn23oH+Tcwt86FB2KLlvqd9Iq2Pwkn23oH+Tcwt865IFUv:sfYeb/FFLQIvYfYeb/WFUv
                                                                                                                                                                                                    MD5:C3F24038AE36784F26CE16B0DAC13BB8
                                                                                                                                                                                                    SHA1:A6AA03AD339E4F0E66949058470C3B5D9A6DD089
                                                                                                                                                                                                    SHA-256:3342BD31DCB3C8BBCF754D15909D7A5D6C12B4EFF6B7C1707F706632D2FED030
                                                                                                                                                                                                    SHA-512:C259CA3B9D5F6996069FDCCE6BFD66DE53591CA344CB7CA0E8C1A19C34041CCF8F73D1BD5F213830B2D90F309DF94D4E8B7EA8D611A6665E2826106457198942
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.625 1e90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/03/14-09:25:34.916 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1197
                                                                                                                                                                                                    Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                                                                                                                                    MD5:A2A3B1383E3AAC2430F44FC7BF3E447E
                                                                                                                                                                                                    SHA1:B807210A1205126A107A5FE25F070D2879407AA4
                                                                                                                                                                                                    SHA-256:90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
                                                                                                                                                                                                    SHA-512:396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):322
                                                                                                                                                                                                    Entropy (8bit):5.130631494948624
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqdNq2Pwkn23oH+Tcwt8NIFUt88qdnLXZmw+8qd4xzkwOwkn23oH+Tcwt8+eLJ:6vYfYebpFUt83LX/++z5JfYebqJ
                                                                                                                                                                                                    MD5:1BBE4E8BF6E08282C904B3D783D391EB
                                                                                                                                                                                                    SHA1:221C073FB0CFC46D0CE8ADE0908073D34F4F3087
                                                                                                                                                                                                    SHA-256:E3CF09B86FFA4FD8C78BF148485E350944F14BA8BD60180D7AFF1657DEB8912B
                                                                                                                                                                                                    SHA-512:CC736937EF6B8AF31572B3E0CA1CC383DD7A86E861351EDCE8357B4C8AE8ED1484DD714456184036D9723B406DE6EBB57C5B255282506D64F9CA10F1C7B929C0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.922 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/03/14-09:25:34.923 1e90 Recovering log #3.2024/03/14-09:25:34.924 1e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):322
                                                                                                                                                                                                    Entropy (8bit):5.130631494948624
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqdNq2Pwkn23oH+Tcwt8NIFUt88qdnLXZmw+8qd4xzkwOwkn23oH+Tcwt8+eLJ:6vYfYebpFUt83LX/++z5JfYebqJ
                                                                                                                                                                                                    MD5:1BBE4E8BF6E08282C904B3D783D391EB
                                                                                                                                                                                                    SHA1:221C073FB0CFC46D0CE8ADE0908073D34F4F3087
                                                                                                                                                                                                    SHA-256:E3CF09B86FFA4FD8C78BF148485E350944F14BA8BD60180D7AFF1657DEB8912B
                                                                                                                                                                                                    SHA-512:CC736937EF6B8AF31572B3E0CA1CC383DD7A86E861351EDCE8357B4C8AE8ED1484DD714456184036D9723B406DE6EBB57C5B255282506D64F9CA10F1C7B929C0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.922 1e90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/03/14-09:25:34.923 1e90 Recovering log #3.2024/03/14-09:25:34.924 1e90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                                    Entropy (8bit):0.3169096321222068
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
                                                                                                                                                                                                    MD5:2554AD7847B0D04963FDAE908DB81074
                                                                                                                                                                                                    SHA1:F84ABD8D05D7B0DFB693485614ECF5204989B74A
                                                                                                                                                                                                    SHA-256:F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
                                                                                                                                                                                                    SHA-512:13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                                                    Entropy (8bit):0.40981274649195937
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
                                                                                                                                                                                                    MD5:1A7F642FD4F71A656BE75B26B2D9ED79
                                                                                                                                                                                                    SHA1:51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
                                                                                                                                                                                                    SHA-256:B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
                                                                                                                                                                                                    SHA-512:FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):429
                                                                                                                                                                                                    Entropy (8bit):5.809210454117189
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                                                                                                                                                                    MD5:5D1D9020CCEFD76CA661902E0C229087
                                                                                                                                                                                                    SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                                                                                                                                                                    SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                                                                                                                                                                    SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):159744
                                                                                                                                                                                                    Entropy (8bit):0.5241404324800358
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
                                                                                                                                                                                                    MD5:241322143A01979D346689D9448AC8C0
                                                                                                                                                                                                    SHA1:DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
                                                                                                                                                                                                    SHA-256:65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
                                                                                                                                                                                                    SHA-512:9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8720
                                                                                                                                                                                                    Entropy (8bit):0.32872990409968056
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:+0A/J3+t76Y4QZZofU99pO0BY7VSqR4EZY4QZvGXyn:MhHQws9LdObBQZGin
                                                                                                                                                                                                    MD5:41CB2073C5E4535BD9160DDF702AFA5E
                                                                                                                                                                                                    SHA1:DFBBC461412AD7E6E5C9DF7F2F870CD30CD55E52
                                                                                                                                                                                                    SHA-256:0CFE25C33BB28E66F6DC4C66513CAE814AA91600550D84EFBFB020B87CDBC873
                                                                                                                                                                                                    SHA-512:D418C279A636AD2A47ECD6B16BB50543E7F785068D63496C277ABE53C778A8F33BAB03D2A775F2F05F21A0EE4E0EE042AE0546E759782053EAF828AB0DB79DC4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............^.S....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):28672
                                                                                                                                                                                                    Entropy (8bit):0.33890226319329847
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
                                                                                                                                                                                                    MD5:971F4C153D386AC7ED39363C31E854FC
                                                                                                                                                                                                    SHA1:339841CA0088C9EABDE4AACC8567D2289CCB9544
                                                                                                                                                                                                    SHA-256:B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
                                                                                                                                                                                                    SHA-512:1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):406
                                                                                                                                                                                                    Entropy (8bit):5.265406051061901
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:KFvYfYeb8rcHEZrELFUt8p5F/+p5X5JfYeb8rcHEZrEZSJ:6YfYeb8nZrExg8nqJJfYeb8nZrEZe
                                                                                                                                                                                                    MD5:6F4CC20F17FE21E8A329EEF57C717595
                                                                                                                                                                                                    SHA1:DA6CB5CC0F7EEFA7A2FF0753759A1D0D4A6A5449
                                                                                                                                                                                                    SHA-256:B3C6092C69C9C6A37F8E03F9C42451696B656BF965145B1782117E73A5983E71
                                                                                                                                                                                                    SHA-512:FC3770BB1914CD8FA4647E7C1295333092005770AEEB3F4391DFC57CC5EABB239F5DCEF2EB47535BAF1296FFC725391CCABD9A3EAAE2E08C733D3D98FA88E0A9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:35.700 1e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/03/14-09:25:35.701 1e44 Recovering log #3.2024/03/14-09:25:35.701 1e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):406
                                                                                                                                                                                                    Entropy (8bit):5.265406051061901
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:KFvYfYeb8rcHEZrELFUt8p5F/+p5X5JfYeb8rcHEZrEZSJ:6YfYeb8nZrExg8nqJJfYeb8nZrEZe
                                                                                                                                                                                                    MD5:6F4CC20F17FE21E8A329EEF57C717595
                                                                                                                                                                                                    SHA1:DA6CB5CC0F7EEFA7A2FF0753759A1D0D4A6A5449
                                                                                                                                                                                                    SHA-256:B3C6092C69C9C6A37F8E03F9C42451696B656BF965145B1782117E73A5983E71
                                                                                                                                                                                                    SHA-512:FC3770BB1914CD8FA4647E7C1295333092005770AEEB3F4391DFC57CC5EABB239F5DCEF2EB47535BAF1296FFC725391CCABD9A3EAAE2E08C733D3D98FA88E0A9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:35.700 1e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/03/14-09:25:35.701 1e44 Recovering log #3.2024/03/14-09:25:35.701 1e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):334
                                                                                                                                                                                                    Entropy (8bit):5.217620640413994
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqbZpL+q2Pwkn23oH+Tcwt8a2jMGIFUt88qbOJ1Zmw+8qb3jUaLVkwOwkn23oH+k:K+vYfYeb8EFUt8pw1/+pt5JfYeb8bJ
                                                                                                                                                                                                    MD5:FE15DBCAC25B22FDA2BC4E479B93E2FF
                                                                                                                                                                                                    SHA1:7C1048E54B2409346A1C2DCFAF1FC181B65284C0
                                                                                                                                                                                                    SHA-256:9F498EA0445827986602315D9753A0012F3FBE53D7FB272A1C7CCAC261DA4B35
                                                                                                                                                                                                    SHA-512:8EBDC3E0EB2B2EE00A3C1671FDB13922F4677FF478F5132269A3C429954029D24206B1CD7935108B395C99A58C321DCB6543B7A86F4840DF3B0AC013360FC378
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:35.071 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:25:35.072 1f78 Recovering log #3.2024/03/14-09:25:35.084 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):334
                                                                                                                                                                                                    Entropy (8bit):5.217620640413994
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqbZpL+q2Pwkn23oH+Tcwt8a2jMGIFUt88qbOJ1Zmw+8qb3jUaLVkwOwkn23oH+k:K+vYfYeb8EFUt8pw1/+pt5JfYeb8bJ
                                                                                                                                                                                                    MD5:FE15DBCAC25B22FDA2BC4E479B93E2FF
                                                                                                                                                                                                    SHA1:7C1048E54B2409346A1C2DCFAF1FC181B65284C0
                                                                                                                                                                                                    SHA-256:9F498EA0445827986602315D9753A0012F3FBE53D7FB272A1C7CCAC261DA4B35
                                                                                                                                                                                                    SHA-512:8EBDC3E0EB2B2EE00A3C1671FDB13922F4677FF478F5132269A3C429954029D24206B1CD7935108B395C99A58C321DCB6543B7A86F4840DF3B0AC013360FC378
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:35.071 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:25:35.072 1f78 Recovering log #3.2024/03/14-09:25:35.084 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):57344
                                                                                                                                                                                                    Entropy (8bit):0.863060653641558
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                                                                                                                                                                    MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                                                                                                                                                                    SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                                                                                                                                                                    SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                                                                                                                                                                    SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):45056
                                                                                                                                                                                                    Entropy (8bit):0.40293591932113104
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
                                                                                                                                                                                                    MD5:ADC0CFB8A1A20DE2C4AB738B413CBEA4
                                                                                                                                                                                                    SHA1:238EF489E5FDC6EBB36F09D415FB353350E7097B
                                                                                                                                                                                                    SHA-256:7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
                                                                                                                                                                                                    SHA-512:38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0601210d-4607-455c-ab68-e20a41c48b56.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2e899954-4a11-4a6e-919d-1c4b61b9ecc9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5533ed6e-7128-482d-a313-4825b1f02ecb.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\68b574dc-698e-4f21-9a96-bb80841366d2.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                                    Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                    MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                    SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                    SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                    SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):61
                                                                                                                                                                                                    Entropy (8bit):3.926136109079379
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                                                                                                                                    MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                                                                                                                                    SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                                                                                                                                    SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                                                                                                                                    SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF31473.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):61
                                                                                                                                                                                                    Entropy (8bit):3.926136109079379
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                                                                                                                                    MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                                                                                                                                    SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                                                                                                                                    SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                                                                                                                                    SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3fef3.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):61
                                                                                                                                                                                                    Entropy (8bit):3.926136109079379
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                                                                                                                                    MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                                                                                                                                    SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                                                                                                                                    SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                                                                                                                                    SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36864
                                                                                                                                                                                                    Entropy (8bit):0.555790634850688
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                                                                                                                                    MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                                                                                                                                    SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                                                                                                                                    SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                                                                                                                                    SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2fdce.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF32f3f.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):203
                                                                                                                                                                                                    Entropy (8bit):5.4042796420747425
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                                                                                                                                    MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                                                                                                                                    SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                                                                                                                                    SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                                                                                                                                    SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF31d6c.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):203
                                                                                                                                                                                                    Entropy (8bit):5.4042796420747425
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                                                                                                                                    MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                                                                                                                                    SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                                                                                                                                    SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                                                                                                                                    SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36864
                                                                                                                                                                                                    Entropy (8bit):0.36515621748816035
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                                                                                                                                    MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                                                                                                                                    SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                                                                                                                                    SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                                                                                                                                    SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0d1c25a-fc66-4574-9275-8c72a31be838.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):111
                                                                                                                                                                                                    Entropy (8bit):4.718418993774295
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                                                                                                                                    MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                                                                                                                                    SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                                                                                                                                    SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                                                                                                                                    SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bb3451d1-fb77-44d2-bb75-94aea0f49bb6.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                                    Entropy (8bit):5.423404609678128
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
                                                                                                                                                                                                    MD5:6833E2FEEACF2930174137246FC7E09F
                                                                                                                                                                                                    SHA1:7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
                                                                                                                                                                                                    SHA-256:839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
                                                                                                                                                                                                    SHA-512:B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc2a07ad-4821-4ddc-b2bf-ac8faec5faa9.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):881
                                                                                                                                                                                                    Entropy (8bit):5.298617157234878
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:YXsYeZVMdBsYCZFRudFGcsYyZFGJ/dbG7nby:YXsYa8sY2fcdsYmgzbZ
                                                                                                                                                                                                    MD5:4F2C07DDF91A0692A683E5E3DCE2B04D
                                                                                                                                                                                                    SHA1:B319E8A40956890FED7609AC0DBB5C78098CDF34
                                                                                                                                                                                                    SHA-256:6F85941275AF66D3140A445ED4874E3863EA539BCD71CE3C454215B795EB4E6A
                                                                                                                                                                                                    SHA-512:82233465A86ACA4A8C355C9C4ED3781C9C7ACC707DB9CF210A46D798994B12CCB912CA4DEE5902995A99BC64ADB9876A1ACD00C7D50EE6B0F5144EFEFC0D5B62
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357470336468241","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357470337337670","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13357470355593757","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                                    Entropy (8bit):0.46731661083066856
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
                                                                                                                                                                                                    MD5:E93ACF0820CA08E5A5D2D159729F70E3
                                                                                                                                                                                                    SHA1:2C1A4D4924B9AEC1A796F108607404B000877C5D
                                                                                                                                                                                                    SHA-256:F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
                                                                                                                                                                                                    SHA-512:3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7726
                                                                                                                                                                                                    Entropy (8bit):4.912929779644774
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sVrjql4J1Pb9JwbvlNYnedY5Th6Cp9/x+6M8muecmAeCYe4zvrN+2X6gS5AtEHb:sVPnJZovlNYnAYPpj+FVAON+FJf
                                                                                                                                                                                                    MD5:9C7A64B63AC4AD7702EAB4F658C62286
                                                                                                                                                                                                    SHA1:ACDD22B75F399BC7927ACFD0B52E81F904CE6E62
                                                                                                                                                                                                    SHA-256:CEA34C5B3D895994DEA11A8F6E52288D3A974887C389F7F634DD3376908DACFF
                                                                                                                                                                                                    SHA-512:ED17F719371FBB8698D6301F1817135F6CA7A43EF71E2CA14EAB5B8E7D7DC2A58408CD0F0B9B76A054E2ADB0E242FFC9162798B387054BD16C4706F8A697158F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33307.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7726
                                                                                                                                                                                                    Entropy (8bit):4.912929779644774
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sVrjql4J1Pb9JwbvlNYnedY5Th6Cp9/x+6M8muecmAeCYe4zvrN+2X6gS5AtEHb:sVPnJZovlNYnAYPpj+FVAON+FJf
                                                                                                                                                                                                    MD5:9C7A64B63AC4AD7702EAB4F658C62286
                                                                                                                                                                                                    SHA1:ACDD22B75F399BC7927ACFD0B52E81F904CE6E62
                                                                                                                                                                                                    SHA-256:CEA34C5B3D895994DEA11A8F6E52288D3A974887C389F7F634DD3376908DACFF
                                                                                                                                                                                                    SHA-512:ED17F719371FBB8698D6301F1817135F6CA7A43EF71E2CA14EAB5B8E7D7DC2A58408CD0F0B9B76A054E2ADB0E242FFC9162798B387054BD16C4706F8A697158F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35bbd.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7726
                                                                                                                                                                                                    Entropy (8bit):4.912929779644774
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sVrjql4J1Pb9JwbvlNYnedY5Th6Cp9/x+6M8muecmAeCYe4zvrN+2X6gS5AtEHb:sVPnJZovlNYnAYPpj+FVAON+FJf
                                                                                                                                                                                                    MD5:9C7A64B63AC4AD7702EAB4F658C62286
                                                                                                                                                                                                    SHA1:ACDD22B75F399BC7927ACFD0B52E81F904CE6E62
                                                                                                                                                                                                    SHA-256:CEA34C5B3D895994DEA11A8F6E52288D3A974887C389F7F634DD3376908DACFF
                                                                                                                                                                                                    SHA-512:ED17F719371FBB8698D6301F1817135F6CA7A43EF71E2CA14EAB5B8E7D7DC2A58408CD0F0B9B76A054E2ADB0E242FFC9162798B387054BD16C4706F8A697158F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3bbcf.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7726
                                                                                                                                                                                                    Entropy (8bit):4.912929779644774
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sVrjql4J1Pb9JwbvlNYnedY5Th6Cp9/x+6M8muecmAeCYe4zvrN+2X6gS5AtEHb:sVPnJZovlNYnAYPpj+FVAON+FJf
                                                                                                                                                                                                    MD5:9C7A64B63AC4AD7702EAB4F658C62286
                                                                                                                                                                                                    SHA1:ACDD22B75F399BC7927ACFD0B52E81F904CE6E62
                                                                                                                                                                                                    SHA-256:CEA34C5B3D895994DEA11A8F6E52288D3A974887C389F7F634DD3376908DACFF
                                                                                                                                                                                                    SHA-512:ED17F719371FBB8698D6301F1817135F6CA7A43EF71E2CA14EAB5B8E7D7DC2A58408CD0F0B9B76A054E2ADB0E242FFC9162798B387054BD16C4706F8A697158F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3efd0.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):7726
                                                                                                                                                                                                    Entropy (8bit):4.912929779644774
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:sVrjql4J1Pb9JwbvlNYnedY5Th6Cp9/x+6M8muecmAeCYe4zvrN+2X6gS5AtEHb:sVPnJZovlNYnAYPpj+FVAON+FJf
                                                                                                                                                                                                    MD5:9C7A64B63AC4AD7702EAB4F658C62286
                                                                                                                                                                                                    SHA1:ACDD22B75F399BC7927ACFD0B52E81F904CE6E62
                                                                                                                                                                                                    SHA-256:CEA34C5B3D895994DEA11A8F6E52288D3A974887C389F7F634DD3376908DACFF
                                                                                                                                                                                                    SHA-512:ED17F719371FBB8698D6301F1817135F6CA7A43EF71E2CA14EAB5B8E7D7DC2A58408CD0F0B9B76A054E2ADB0E242FFC9162798B387054BD16C4706F8A697158F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):33
                                                                                                                                                                                                    Entropy (8bit):4.051821770808046
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                                                                                                                                                                                    MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                                                                                                                                    SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                                                                                                                                    SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                                                                                                                                    SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"preferred_apps":[],"version":1}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25012
                                                                                                                                                                                                    Entropy (8bit):5.566931743099954
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:vTkZFDWPAmf/y8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0NuQjrw0pdtui:vTkZFDWPAmf/yu1jalIQYKt1
                                                                                                                                                                                                    MD5:533609005784B64831C1B9297FC73EFD
                                                                                                                                                                                                    SHA1:F395F32CCD59FE7E7CA82D341B5A8C76ACFC11CE
                                                                                                                                                                                                    SHA-256:E82BA50C655C2163CF70779E035C22C8DC197A5C62EDC4FB8977A83B1D8B146F
                                                                                                                                                                                                    SHA-512:97BE09A151FB2E257C69666DC52FA166D73D13DD9EA97777A09635417E94A1DA439B3F76DC4BC394C12D777E2B665F4420C308A466C43EBEEF137E5E44884CDF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354878334243509","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354878334243509","location":5,"ma

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF34586.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25012
                                                                                                                                                                                                    Entropy (8bit):5.566931743099954
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:vTkZFDWPAmf/y8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0NuQjrw0pdtui:vTkZFDWPAmf/yu1jalIQYKt1
                                                                                                                                                                                                    MD5:533609005784B64831C1B9297FC73EFD
                                                                                                                                                                                                    SHA1:F395F32CCD59FE7E7CA82D341B5A8C76ACFC11CE
                                                                                                                                                                                                    SHA-256:E82BA50C655C2163CF70779E035C22C8DC197A5C62EDC4FB8977A83B1D8B146F
                                                                                                                                                                                                    SHA-512:97BE09A151FB2E257C69666DC52FA166D73D13DD9EA97777A09635417E94A1DA439B3F76DC4BC394C12D777E2B665F4420C308A466C43EBEEF137E5E44884CDF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13354878334243509","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13354878334243509","location":5,"ma

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):232
                                                                                                                                                                                                    Entropy (8bit):2.7061121767675385
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
                                                                                                                                                                                                    MD5:8A30A1FDD0459D9EA8B1E78A8E636856
                                                                                                                                                                                                    SHA1:9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
                                                                                                                                                                                                    SHA-256:88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
                                                                                                                                                                                                    SHA-512:B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):322
                                                                                                                                                                                                    Entropy (8bit):5.191086031508803
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqjjL+q2Pwkn23oH+TcwtrQMxIFUt88qbFJ1Zmw+8qXFUaLVkwOwkn23oH+Tcwtf:rvYfYebCFUt8RFJ1/+dFU+5JfYebtJ
                                                                                                                                                                                                    MD5:6E372D6E0F68E0FEF7A5AEAE9EA81EBF
                                                                                                                                                                                                    SHA1:20634453616D0F9ED2130C9EBF090CA6BF64B69E
                                                                                                                                                                                                    SHA-256:96B3FC28E5A99B7B4CD1F2C02895D6D68837556164BD2FBEF7EB66932F3DD87D
                                                                                                                                                                                                    SHA-512:8D40E8DE66A1AECEB900802C7A2A9C8C33307A2CFEB8E21CBD29AAAEA37C112CDA95F7AA33C672CC997DBC7A6798CD883AF40666C385C38A0D084A6427BD60E4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:50.573 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/03/14-09:25:50.584 1f78 Recovering log #3.2024/03/14-09:25:50.588 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):322
                                                                                                                                                                                                    Entropy (8bit):5.191086031508803
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqjjL+q2Pwkn23oH+TcwtrQMxIFUt88qbFJ1Zmw+8qXFUaLVkwOwkn23oH+Tcwtf:rvYfYebCFUt8RFJ1/+dFU+5JfYebtJ
                                                                                                                                                                                                    MD5:6E372D6E0F68E0FEF7A5AEAE9EA81EBF
                                                                                                                                                                                                    SHA1:20634453616D0F9ED2130C9EBF090CA6BF64B69E
                                                                                                                                                                                                    SHA-256:96B3FC28E5A99B7B4CD1F2C02895D6D68837556164BD2FBEF7EB66932F3DD87D
                                                                                                                                                                                                    SHA-512:8D40E8DE66A1AECEB900802C7A2A9C8C33307A2CFEB8E21CBD29AAAEA37C112CDA95F7AA33C672CC997DBC7A6798CD883AF40666C385C38A0D084A6427BD60E4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:50.573 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/03/14-09:25:50.584 1f78 Recovering log #3.2024/03/14-09:25:50.588 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):350
                                                                                                                                                                                                    Entropy (8bit):5.153180608349392
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqaAI+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88qiZmw+8q+VkwOwkn23oH+Tcwt7Uh2w:ydvYfYebIhHh2FUt8M/+s5JfYebIhHLJ
                                                                                                                                                                                                    MD5:F53E0537B7B7C5E7C473E54F42A8FB3B
                                                                                                                                                                                                    SHA1:2AD22D947F162F17E0C7F358A82DCDF0B1FE2724
                                                                                                                                                                                                    SHA-256:253B51DDBA88B89A7C8568BE713AFE69506E145A0B3A0C75CEB3B9630572D811
                                                                                                                                                                                                    SHA-512:F55FB9E0DCBA7054D5C64C22D6A0AC9686CC3FEE13E5698E8672BD2DFFC77D726DB6E69BE3DE0513822824B56CFEBF78A2A649D0C8AD129BFE94519A0AE9032C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.241 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/03/14-09:25:34.243 1e98 Recovering log #3.2024/03/14-09:25:34.243 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):350
                                                                                                                                                                                                    Entropy (8bit):5.153180608349392
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqaAI+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88qiZmw+8q+VkwOwkn23oH+Tcwt7Uh2w:ydvYfYebIhHh2FUt8M/+s5JfYebIhHLJ
                                                                                                                                                                                                    MD5:F53E0537B7B7C5E7C473E54F42A8FB3B
                                                                                                                                                                                                    SHA1:2AD22D947F162F17E0C7F358A82DCDF0B1FE2724
                                                                                                                                                                                                    SHA-256:253B51DDBA88B89A7C8568BE713AFE69506E145A0B3A0C75CEB3B9630572D811
                                                                                                                                                                                                    SHA-512:F55FB9E0DCBA7054D5C64C22D6A0AC9686CC3FEE13E5698E8672BD2DFFC77D726DB6E69BE3DE0513822824B56CFEBF78A2A649D0C8AD129BFE94519A0AE9032C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.241 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/03/14-09:25:34.243 1e98 Recovering log #3.2024/03/14-09:25:34.243 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsFl:/F
                                                                                                                                                                                                    MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                    SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                    SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                    SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                                                    Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                    MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                    SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                    SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                    SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                    MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                    SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                    SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                    SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                    MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                    SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                    SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                    SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):524656
                                                                                                                                                                                                    Entropy (8bit):5.027445846313988E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LsuldO4:LsCp
                                                                                                                                                                                                    MD5:EB952567898951527DB0DD6169D55673
                                                                                                                                                                                                    SHA1:49BE69F498813245102AAAE9CEAA4B31CF064459
                                                                                                                                                                                                    SHA-256:63CCC73473776417AE3B1019180105EC7FB5255AEAA9716C0771D9069DA63423
                                                                                                                                                                                                    SHA-512:3C42B3D98D0A81A6CF2A1E53AE0680D5645FECE00781FEB4738D762FE93CDDC73B016503FA15C6CA6EC16345FC7600490369B4F2F8B8245530F816C67714ECE9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................w.~.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsFl:/F
                                                                                                                                                                                                    MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                    SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                    SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                    SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                                                    Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                    MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                    SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                    SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                    SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                    MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                    SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                    SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                    SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                    MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                    SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                    SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                    SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):262512
                                                                                                                                                                                                    Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LsNl4t:Ls34t
                                                                                                                                                                                                    MD5:7E4B95A04BFA40F438BDDB72424DE479
                                                                                                                                                                                                    SHA1:C46CF8B914FA16B5A10F352008772FB74633C355
                                                                                                                                                                                                    SHA-256:668EB9A04E4D9F47D171AA520C0C8F974E2A1ACBD13E0B7E4B02858740420EBF
                                                                                                                                                                                                    SHA-512:EF01B5C2BDE1C51D9A93E011F85F018DC056BB92DA69546D258437ED737860389008ED196AB13B03955A9304FF62472347C43A055258F99E1E122B1D62A65FBA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.........................................!*.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                                                    Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                    MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                    SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                    SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                    SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):432
                                                                                                                                                                                                    Entropy (8bit):5.268811697653753
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:KNvYfYebvqBQFUt8ph1/+pv5JfYebvqBvJ:2YfYebvZg8UJfYebvk
                                                                                                                                                                                                    MD5:52A84CBC595B619AA52AF8E4F94D4D90
                                                                                                                                                                                                    SHA1:4F36C2836AEEE7D71243073F6C2A9E47C399A1C8
                                                                                                                                                                                                    SHA-256:6C0375219DDE0F7A9FA9A92C48F634EFED4DDB1438880B34185B54478F3D5786
                                                                                                                                                                                                    SHA-512:DB836F9783A4F8C12CA7330A8241B95854FE9D6909E49900DD966AF0C757E9AE5E6EC046AFEABEDB541900977410DD80B705CFA93277F47F9A3F7C6C5149E102
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:35.100 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:25:35.101 1f78 Recovering log #3.2024/03/14-09:25:35.110 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):432
                                                                                                                                                                                                    Entropy (8bit):5.268811697653753
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:KNvYfYebvqBQFUt8ph1/+pv5JfYebvqBvJ:2YfYebvZg8UJfYebvk
                                                                                                                                                                                                    MD5:52A84CBC595B619AA52AF8E4F94D4D90
                                                                                                                                                                                                    SHA1:4F36C2836AEEE7D71243073F6C2A9E47C399A1C8
                                                                                                                                                                                                    SHA-256:6C0375219DDE0F7A9FA9A92C48F634EFED4DDB1438880B34185B54478F3D5786
                                                                                                                                                                                                    SHA-512:DB836F9783A4F8C12CA7330A8241B95854FE9D6909E49900DD966AF0C757E9AE5E6EC046AFEABEDB541900977410DD80B705CFA93277F47F9A3F7C6C5149E102
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:35.100 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/03/14-09:25:35.101 1f78 Recovering log #3.2024/03/14-09:25:35.110 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2365dc06-ca72-42e5-bd2e-69d56e9dcb24.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\456bd652-d27f-4c05-a40d-7061f30a0e0c.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9808e242-2c09-4b73-8e4d-a3c663660a29.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):193
                                                                                                                                                                                                    Entropy (8bit):4.864047146590611
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                                                                                                                                    MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                                                                                                                                    SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                                                                                                                                    SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                                                                                                                                    SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF40b47.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):193
                                                                                                                                                                                                    Entropy (8bit):4.864047146590611
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                                                                                                                                    MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                                                                                                                                    SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                                                                                                                                    SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                                                                                                                                    SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36864
                                                                                                                                                                                                    Entropy (8bit):0.555790634850688
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                                                                                                                                    MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                                                                                                                                    SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                                                                                                                                    SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                                                                                                                                    SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF32f3f.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):36864
                                                                                                                                                                                                    Entropy (8bit):0.36515621748816035
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                                                                                                                                    MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                                                                                                                                    SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                                                                                                                                    SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                                                                                                                                    SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c1f42d3f-7f79-4057-8072-bbcf7b70ac0b.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):111
                                                                                                                                                                                                    Entropy (8bit):4.718418993774295
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                                                                                                                                    MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                                                                                                                                    SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                                                                                                                                    SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                                                                                                                                    SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):80
                                                                                                                                                                                                    Entropy (8bit):3.4921535629071894
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                                                                                                                                    MD5:69449520FD9C139C534E2970342C6BD8
                                                                                                                                                                                                    SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                                                                                                                                    SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                                                                                                                                    SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):420
                                                                                                                                                                                                    Entropy (8bit):5.301719164541518
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:4EOvYfYebvqBZFUt8J1/+y5JfYebvqBaJ:4EMYfYebvyg8dJfYebvL
                                                                                                                                                                                                    MD5:52F2FA357799B81D81FF329EDBE37347
                                                                                                                                                                                                    SHA1:22E228C8A39C9DBEDE9D0DBADE981AC58F4D2B4D
                                                                                                                                                                                                    SHA-256:7B0D647884E02ED05FDD15970F26CA5F9A346B26998A10A3DEA5749A1FA0FFFE
                                                                                                                                                                                                    SHA-512:A5322525157ACDE4056A90DF7B7E2B3BB24BA48480FCA7E2A9A4BAE819B2021FB5A547FE7F79AA5F71895AC163F210D51DBCC1022A2FC3A50EBA1E24E4F00879
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:50.659 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/03/14-09:25:50.661 1f78 Recovering log #3.2024/03/14-09:25:50.666 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):420
                                                                                                                                                                                                    Entropy (8bit):5.301719164541518
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:4EOvYfYebvqBZFUt8J1/+y5JfYebvqBaJ:4EMYfYebvyg8dJfYebvL
                                                                                                                                                                                                    MD5:52F2FA357799B81D81FF329EDBE37347
                                                                                                                                                                                                    SHA1:22E228C8A39C9DBEDE9D0DBADE981AC58F4D2B4D
                                                                                                                                                                                                    SHA-256:7B0D647884E02ED05FDD15970F26CA5F9A346B26998A10A3DEA5749A1FA0FFFE
                                                                                                                                                                                                    SHA-512:A5322525157ACDE4056A90DF7B7E2B3BB24BA48480FCA7E2A9A4BAE819B2021FB5A547FE7F79AA5F71895AC163F210D51DBCC1022A2FC3A50EBA1E24E4F00879
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:50.659 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/03/14-09:25:50.661 1f78 Recovering log #3.2024/03/14-09:25:50.666 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):326
                                                                                                                                                                                                    Entropy (8bit):5.217646843007584
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqXOayq2Pwkn23oH+TcwtpIFUt88qXT91Zmw+8qXmRkwOwkn23oH+Tcwta/WLJ:oO/vYfYebmFUt8dZ1/+dS5JfYebaUJ
                                                                                                                                                                                                    MD5:B0AB24D599051A33E0ED7AF7992B5441
                                                                                                                                                                                                    SHA1:4EAED76293BE3091A6DA5263B1AB087E863B67EF
                                                                                                                                                                                                    SHA-256:FF2BD602A9CCF26A5C0022CCDA0B99E033C8CDC0908A07CCE4DA43B4BDEBEF1A
                                                                                                                                                                                                    SHA-512:E375ACAB668453F852DA8704ECD0C1A3896E53D91D51654321EF7ADF78580F52A26494E19AA83D06D589503C39D4CF27C1F7065CE7519CB0D54259890005BE62
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.338 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/03/14-09:25:34.341 1e94 Recovering log #3.2024/03/14-09:25:34.368 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):326
                                                                                                                                                                                                    Entropy (8bit):5.217646843007584
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqXOayq2Pwkn23oH+TcwtpIFUt88qXT91Zmw+8qXmRkwOwkn23oH+Tcwta/WLJ:oO/vYfYebmFUt8dZ1/+dS5JfYebaUJ
                                                                                                                                                                                                    MD5:B0AB24D599051A33E0ED7AF7992B5441
                                                                                                                                                                                                    SHA1:4EAED76293BE3091A6DA5263B1AB087E863B67EF
                                                                                                                                                                                                    SHA-256:FF2BD602A9CCF26A5C0022CCDA0B99E033C8CDC0908A07CCE4DA43B4BDEBEF1A
                                                                                                                                                                                                    SHA-512:E375ACAB668453F852DA8704ECD0C1A3896E53D91D51654321EF7ADF78580F52A26494E19AA83D06D589503C39D4CF27C1F7065CE7519CB0D54259890005BE62
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.338 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/03/14-09:25:34.341 1e94 Recovering log #3.2024/03/14-09:25:34.368 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):28672
                                                                                                                                                                                                    Entropy (8bit):0.26707851465859517
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
                                                                                                                                                                                                    MD5:04F8B790DF73BD7CD01238F4681C3F44
                                                                                                                                                                                                    SHA1:DF12D0A21935FC01B36A24BF72AB9640FEBB2077
                                                                                                                                                                                                    SHA-256:96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
                                                                                                                                                                                                    SHA-512:0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):180224
                                                                                                                                                                                                    Entropy (8bit):0.9237410161604507
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
                                                                                                                                                                                                    MD5:C97C2FBAAEA45BB3C728D02689216CB2
                                                                                                                                                                                                    SHA1:CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
                                                                                                                                                                                                    SHA-256:DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
                                                                                                                                                                                                    SHA-512:5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2568
                                                                                                                                                                                                    Entropy (8bit):0.06462527237038726
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:8yll/l1lhtli:ZF3S
                                                                                                                                                                                                    MD5:8B50CA28E3995B73AABC9E81A4953EC9
                                                                                                                                                                                                    SHA1:4CDD1BE20EEA3DBE1A777D9A9DEB22DA4562A4C0
                                                                                                                                                                                                    SHA-256:1DA51231CF9837593E10C4884291866AC07A2E20C4979FA9F9D490B5F79E5154
                                                                                                                                                                                                    SHA-512:6B9FF7780089D877B83BBB760575C910EDD4E2D62C3C8F3B8F63CDEEF57AF84B947A2E0AADB23A3AFA89F836E7EC9A89CF602F3412F348247026C6C388DF3AB4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..............{....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11755
                                                                                                                                                                                                    Entropy (8bit):5.190465908239046
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                                                                                                                                    MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                                                                                                                                    SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                                                                                                                                    SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                                                                                                                                    SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cfab86f1-8226-4279-9248-00fa2f64133c.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9332
                                                                                                                                                                                                    Entropy (8bit):5.184995920933409
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:sVnnJZovler/Lthx5YnsYPpj+FVADN+FBf:sVnnJZoNwt7mpUVCNW
                                                                                                                                                                                                    MD5:EEE1282728445605172F8A5F0D86CBEF
                                                                                                                                                                                                    SHA1:FC3AB07D18A01268A7B2C86F094FE07BDC644BC3
                                                                                                                                                                                                    SHA-256:0DCFC521098EE45225242DE0C37D46ED34F7079F46F44A3CC819B5064E9B741E
                                                                                                                                                                                                    SHA-512:F2BBF500CC025C744E88CEC37A6930FD229232A4D6D547CC9C14A84DD53B454EBA942AB760585CBF47C60D9AA91E49BE2723430D9E8364D8318C3978762C9229
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13354878334697305","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e3e1a6e5-5776-446e-9450-354f22e3cd30.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:L:L
                                                                                                                                                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):0.35226517389931394
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                                                                                                                                                                                    MD5:D2CCDC36225684AAE8FA563AFEDB14E7
                                                                                                                                                                                                    SHA1:3759649035F23004A4C30A14C5F0B54191BEBF80
                                                                                                                                                                                                    SHA-256:080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
                                                                                                                                                                                                    SHA-512:1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1566
                                                                                                                                                                                                    Entropy (8bit):5.488717771065051
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:q83SBSqQrPGHRHoxOIYjIYgzQqkBMYjMY5ybAlkfAlk9H3:e0qQSIYjIYgzQbBMYjMYEYcYQ3
                                                                                                                                                                                                    MD5:DE54CDDF2C1CF4083C1073347206DADB
                                                                                                                                                                                                    SHA1:3182828094B782FD7321B9B41787166987640F77
                                                                                                                                                                                                    SHA-256:223E0BEE0CB00CF541559A6DE6C5F6F73CC1D951053C0B3E6F7A57E072C7694D
                                                                                                                                                                                                    SHA-512:0D66996353D5B26A8060B7AD79B622B9FFBC84C18314F762B1543E6C513120A341061731BED2AEFE63DB9FF0428932075E95FE46998FDAE455EB80AB547E9703
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:A..r.................20_1_1...1.,U.................20_1_1...1..!..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch.....4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton....&4_IPH_FocusHelpBubbleScreenReaderPromo*.$IPH_FocusHelpBubbleScreenReaderPromo.....4_IPH_GMCCastStartStop...IPH_GMCCastStartStop.....4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode.....4_IPH_LiveCaption...IPH_LiveCaption.....4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage...."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature.....4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature....&4_IPH_PriceTrackingEmailConsentFeature*.$IPH_PriceTrackingEmailConsentFeature....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature.....4_IPH_De

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):281
                                                                                                                                                                                                    Entropy (8bit):5.236841385899498
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:FqT01wkn23oH+Tcwtfrl2KLlvqT7LQ+q2Pwkn23oH+TcwtfrK+IFUv:sjfYeb1LU3Q+vYfYeb23FUv
                                                                                                                                                                                                    MD5:FB058844C82A47DFF9ACC5F2B1F23FED
                                                                                                                                                                                                    SHA1:10A252DA4286B5203C44C06BFF35E2F68B9A8A37
                                                                                                                                                                                                    SHA-256:6B26FED9478A59703024EA50741EECEBDF5545C95EF344BFFAA84DAAD0077437
                                                                                                                                                                                                    SHA-512:E16074D7791D86998634B5898011C45740D9071AC6AD39E1BE6603610DE921D78C95CAC529A946193DC9C32AB57FE35702DD78B4AC2BF2DC15A3539F6A991630
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.731 1e4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/03/14-09:25:34.748 1e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):729
                                                                                                                                                                                                    Entropy (8bit):3.9440389780590293
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:G0nYUtTNop//z3p/UzeitBUJbZfPsdb3jN7G0lbANqa:G0nYUtypD3RU0FZfElm
                                                                                                                                                                                                    MD5:E37C8BE46C36A5276F38092DFB77DF50
                                                                                                                                                                                                    SHA1:982634DDE362E3368C5F4F24C35EF7DB07DA7526
                                                                                                                                                                                                    SHA-256:6C602B8208B1D56E6EE7BCCCE97B66413389B89DB7624FB11984FCFA54AD45F4
                                                                                                                                                                                                    SHA-512:E3FE90237592C145657D0F3B016EC7AB82E39E7623992825B3C0FAFA884861CC812F590180C044701CCA3B69312E97F116834C58FB5454AECA7A5AE44CB6D56C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_.......N..................3_.........................4_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....I.Ha.................37_......m.}.................38_......7...................3_......C...................4_.....h.#..................39_.....P"...................9_.........................9_.....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):299
                                                                                                                                                                                                    Entropy (8bit):5.193989152711658
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:Fqv41wkn23oH+Tcwtfrzs52KLlvqT0pQ+q2Pwkn23oH+TcwtfrzAdIFUv:uHfYebs9LUaQ+vYfYeb9FUv
                                                                                                                                                                                                    MD5:5BFCB2BA061DA524FBA659C88E42FCF3
                                                                                                                                                                                                    SHA1:1F04E3E6C64ACC9D07B3FE4E320D32D93C91367C
                                                                                                                                                                                                    SHA-256:10660D5F5C5E955FA303DD5620522D6E2F8A849534272046671B82A65B0C0DBB
                                                                                                                                                                                                    SHA-512:F2A1723B7D753779274B6DFA310DDDC50EE93589A2AD08B568D2CF7764534A5053869F05024F5B98E9842743DCFD89C23AE14A465F6558A84F6306074FE39AE4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024/03/14-09:25:34.692 1e4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/03/14-09:25:34.723 1e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsFl:/F
                                                                                                                                                                                                    MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                    SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                    SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                    SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                                                    Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                    MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                    SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                    SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                    SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                    MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                    SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                    SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                    SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                    MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                    SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                    SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                    SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):262512
                                                                                                                                                                                                    Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LsNlfl/:Ls3ft
                                                                                                                                                                                                    MD5:5D1C7CFBF04A0BBE625D0247BE8D06F6
                                                                                                                                                                                                    SHA1:F2907C2EA28E77E42600CDBB44C2140F55EDF4FD
                                                                                                                                                                                                    SHA-256:4DBF9BC70A44E1AC42C14D3DD3111E3059CD5690AF91F685D94C7A187B81FC73
                                                                                                                                                                                                    SHA-512:7AE00CEE7BBB739DC650C7028DC217E5B89957C13DD683F5367AB87EBB163F26DD49A1E924CF05D1C07E5932CD4031790ABC445AE67C8B763A76013E5F387CD9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.........................................=-.0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsFl:/F
                                                                                                                                                                                                    MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                    SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                    SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                    SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                                                    Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                    MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                    SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                    SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                    SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                    MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                    SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                    SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                    SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                    MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                    SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                    SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                    SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):262512
                                                                                                                                                                                                    Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LsNlRol:Ls3Rol
                                                                                                                                                                                                    MD5:CB2737765AABCA9B8A1FEBD5AB19A10C
                                                                                                                                                                                                    SHA1:87A371F780ABC1AB3431B00381663A86A103383A
                                                                                                                                                                                                    SHA-256:DA6C5C8658FEAB30755F6B3740C71DA1456AD0540FF2B8FDD60EA7701DDB69AA
                                                                                                                                                                                                    SHA-512:0369D4260AF29A088995A3C2A9F6F3BCBBF6E9C89C629307D38CD394A3F31D64CC140653FFC082BE21F21B8F4823C29BF0B2E9CAF6A8E57197103495E5CCA0F3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................"...0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):120
                                                                                                                                                                                                    Entropy (8bit):3.32524464792714
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                                                                                                                                    MD5:A397E5983D4A1619E36143B4D804B870
                                                                                                                                                                                                    SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                                                                                                                                    SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                                                                                                                                    SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13
                                                                                                                                                                                                    Entropy (8bit):2.7192945256669794
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                                                                    MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                                                                    SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                                                                    SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                                                                    SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:117.0.2045.47

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2de8e.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dedd.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30706.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF339fd.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33f7b.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33fe8.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c814.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ef33.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44988.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4da9d.TMP (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                                                    Entropy (8bit):5.790156166047174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:iaqkHfKN5ih/cI9URLl8Roto+MFVvlwhke4IbONIeTC6XQS0qGqk+Z4uj+rjEYVt:akiCeiRUJh06qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                    MD5:CEA0B928847143A5BA5C037443A44D6E
                                                                                                                                                                                                    SHA1:4DD1D1688F71E62842972B8B48B07A3EBD1CCC67
                                                                                                                                                                                                    SHA-256:9EA626C59718BFB708725919CBED5AE7C3C417360706EDE889FBD52228554770
                                                                                                                                                                                                    SHA-512:3D5D9F9E6C03ADCA494ACC10CCC68FC38BC0042BB74E35CEC0AD7F7ABAA632E1B177320D84AC4068F170431DE0A8D79B21BE52C061BC4AFB2A9E0BC8BA200081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD0EtIE2C0TToCJW6hj5+FaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACs8LEfJ/lrbti3Ax8EgeBmnEomWWFpzq41n6pkN1SHXgAAAAA

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                                    Entropy (8bit):0.46731661083066856
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
                                                                                                                                                                                                    MD5:E93ACF0820CA08E5A5D2D159729F70E3
                                                                                                                                                                                                    SHA1:2C1A4D4924B9AEC1A796F108607404B000877C5D
                                                                                                                                                                                                    SHA-256:F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
                                                                                                                                                                                                    SHA-512:3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsFl:/F
                                                                                                                                                                                                    MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                    SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                    SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                    SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                                                    Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                    MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                    SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                    SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                    SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                    MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                    SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                    SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                    SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                    MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                    SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                    SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                    SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):262512
                                                                                                                                                                                                    Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:LsNllK/l:Ls3Q/l
                                                                                                                                                                                                    MD5:629C550B48695FC9E15580F7609D5740
                                                                                                                                                                                                    SHA1:95DC7826EAE8F4373ED45A53BA15054E2A6E686F
                                                                                                                                                                                                    SHA-256:4897CC9799BB81A6D7A8712AB9354307AA1DA2E0FDE830C57F4771008C94713A
                                                                                                                                                                                                    SHA-512:55E41241C759D80689DD74DBF6FDF834CA29F5B96BC096670DAC995765F771E3A3733D4CA0F648A800340A77FC104D2928B6AB145C9A0CF2A19F0570ABF17382
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.........................................O..0r/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):29
                                                                                                                                                                                                    Entropy (8bit):3.922828737239167
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:2NGw+K+:fwZ+
                                                                                                                                                                                                    MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                                                                                                                                                                    SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                                                                                                                                                                    SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                                                                                                                                                                    SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:customSynchronousLookupUris_0

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):35302
                                                                                                                                                                                                    Entropy (8bit):7.99333285466604
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                                                                    MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                                                                    SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                                                                    SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                                                                    SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18
                                                                                                                                                                                                    Entropy (8bit):3.5724312513221195
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:kDnaV6bVon:kDYa2
                                                                                                                                                                                                    MD5:5692162977B015E31D5F35F50EFAB9CF
                                                                                                                                                                                                    SHA1:705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
                                                                                                                                                                                                    SHA-256:42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
                                                                                                                                                                                                    SHA-512:32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:edgeSettings_2.0-0

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3581
                                                                                                                                                                                                    Entropy (8bit):4.459693941095613
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                                                                                                                                                                    MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                                                                                                                                                                    SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                                                                                                                                                                    SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                                                                                                                                                                    SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):47
                                                                                                                                                                                                    Entropy (8bit):4.493433469104717
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:kfKbQSQSuLA5:kyUc5
                                                                                                                                                                                                    MD5:3F90757B200B52DCF5FDAC696EFD3D60
                                                                                                                                                                                                    SHA1:569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
                                                                                                                                                                                                    SHA-256:1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
                                                                                                                                                                                                    SHA-512:39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:synchronousLookupUris_636976985063396749.rel.v2

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):35302
                                                                                                                                                                                                    Entropy (8bit):7.99333285466604
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                                                                    MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                                                                    SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                                                                    SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                                                                    SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):86
                                                                                                                                                                                                    Entropy (8bit):4.389669793590032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
                                                                                                                                                                                                    MD5:03B6D5E81A4DC4D4E6C27BE1E932B9D9
                                                                                                                                                                                                    SHA1:3C5EF0615314BDB136AB57C90359F1839BDD5C93
                                                                                                                                                                                                    SHA-256:73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
                                                                                                                                                                                                    SHA-512:0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a4c989bf-e3a3-41cb-9493-16c3c0a0a8f8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):31298
                                                                                                                                                                                                    Entropy (8bit):6.063758035093198
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUiUZB2gAz3DeMQWonubZpG2D:qFmi3bXYTAzCwBZpBD
                                                                                                                                                                                                    MD5:71D6270929B985CB08EA5F224565770D
                                                                                                                                                                                                    SHA1:53E0D2DC856EB3C638EFD039E4AB23E81FBDCECB
                                                                                                                                                                                                    SHA-256:46D1723AFA2ABF6F812271A9FFBC0AE35AC68F3AC235ABC4815B960BD8F6FEE1
                                                                                                                                                                                                    SHA-512:70FC9252B4A42CF7ABC8DBD9BAA286956C062A262FF6B1CE3AEE7028D7D801095A8790D70B1ED98A58B8BD6C71572A49C78C0521C596E245531CDEBDBA31B3D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aecd2c11-20fe-462f-9c63-469064a58150.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):28956
                                                                                                                                                                                                    Entropy (8bit):6.066872647959288
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUBUVgAz30eMQWonubZpG2D:qFmi3bXYZAzVwBZpBD
                                                                                                                                                                                                    MD5:10684F16A129C724CC2222168A237E3F
                                                                                                                                                                                                    SHA1:F23BE63BEBF2EB2CF75102B292311EE07FF6BA5F
                                                                                                                                                                                                    SHA-256:A6119933A55D28E0A3C70DF18BDF74E552F760AAAA9A02635ABD9FB7035A1E52
                                                                                                                                                                                                    SHA-512:9B98489DF0F09CA37AC97FD3D97DAFA4C5E9315FD2B4BB12BB2A314F0A5209757564A2A332EB05752992F266B44359F66762A38560C847F2B325D83E4A075AD5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b23ce3a9-f29c-4581-8910-029b4a973243.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8243
                                                                                                                                                                                                    Entropy (8bit):5.792585797020113
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:fsNAiUeiRUL/4QNkDyW+h6qRAq1k8SPxVLZ7VTiQ:fsNAty/FeDyf6q3QxVNZTiQ
                                                                                                                                                                                                    MD5:78CBC221CCDBE4BE2CDD35EDCF160FB0
                                                                                                                                                                                                    SHA1:21BDA1817E903DD20B9236A6F5EE3485FC7AB104
                                                                                                                                                                                                    SHA-256:571D94264A4E6C36465A2F1D45FA5EAFD5E7A4724F21548DB11D4979117E4189
                                                                                                                                                                                                    SHA-512:EAC6864A09251BC9120A019459F98DAD334A07D22ADBF2D3B3CA6DEAC9C1092C298491C6992AC06ADD32FB39B4AE7A2FD84A3A3B0EEF5A84239975D6897EF63D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c43cd358-6265-4ee6-85d7-a773ca29ebfd.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):26094
                                                                                                                                                                                                    Entropy (8bit):6.070076177388962
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUXUdeDyNeMQWonubZpG2D:qFmi3bXYlwBZpBD
                                                                                                                                                                                                    MD5:2BD46C460A63209126D937DA7220824D
                                                                                                                                                                                                    SHA1:D7EF6CDC80561D0037890B503BD2DE7BD542EB27
                                                                                                                                                                                                    SHA-256:263097F792F6514DEC6A1036BF4F8AA573B2E958AE90BFBFF3E55F0207F9FE1E
                                                                                                                                                                                                    SHA-512:5BEECF16125B1D695243F2154E184445EAE80623D57FBA99D2CC8350A199F173013B71C51258D09BDB15E74CCC1ECAA4C539CD4BA4BA93B19F6FF938DCA2871E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e728ea01-1ea8-45ff-8fee-3f1833d4cbcb.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8325
                                                                                                                                                                                                    Entropy (8bit):5.786544186904275
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:fsNwiUeiRUe/4QNkDyW+h6qRAq1k8SPxVLZ7VTiQ:fsNwtZ/FeDyf6q3QxVNZTiQ
                                                                                                                                                                                                    MD5:F04988DFFA4130493CDBC3489CFA45CC
                                                                                                                                                                                                    SHA1:42BEE250F9BA3F98F7B0FD056FD6695FA86A2002
                                                                                                                                                                                                    SHA-256:5C2A59B9D573A7A69F2C78F1D48AF6636F8B4A3CA1BAA718CB1F52A225616D3D
                                                                                                                                                                                                    SHA-512:E5747CDC488154DFDECA42E4DA795BCD7F004B87E5AA23ABC5D740A7271C863C89CBFD68E58C1C6495E9E0477ACCC480AD7C34DB57EEB85BD9B71AE0B33C6553
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f4c8af1e-10f7-427e-895a-043fec28d23f.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):62674
                                                                                                                                                                                                    Entropy (8bit):6.081063541840158
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:qF5kruq4eVbAXbUiUZBHwqckyFhzq2pLf1wf/ay3CtSoyVrLdrWXz7N3TgAz3Jei:qFmi3bXYszkmprMn/d8zR3cAzwwBZpBD
                                                                                                                                                                                                    MD5:E3F6E8F5D6B0D998DE61A4E9ECB9EED7
                                                                                                                                                                                                    SHA1:B8B9A4385DDE08440D98B220AA1E656AE9A9FFE0
                                                                                                                                                                                                    SHA-256:6CBC8641437E410CC630DC6650C776B621F6493A1B67CE55648F9575A5A42C4F
                                                                                                                                                                                                    SHA-512:E77C40C1CB9A45C0B6561FD912E8B24FB530CE9DC7F33CA5764D1AD9FA2510A284839A64F753DCD4D8024397864D07F0D50E0D2405FB9DB9AF8D63411171337B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"483AA87BBED748390129C70ED7CAF3443459F6FEE63C9F3C73F4DD9E6BF5D63A\"","apps_count_check_time":"13354878334779588","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6AC20484-E1DC-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                                    Entropy (8bit):2.959356343991432
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:Frwcil5HV7lUWhRhSOw8jikjM5HV71R8js:xlGhV7lUWhRhSOwUi1hV7rU
                                                                                                                                                                                                    MD5:C88D0C079BE90E495E8C033D5BE81609
                                                                                                                                                                                                    SHA1:697C3C6FF69F4A145025E102222EF745EA3F75E5
                                                                                                                                                                                                    SHA-256:CAEC05EFF7A7CC9EDF4319B8C83744E6582F10536A1288FD8F09A815300CC92E
                                                                                                                                                                                                    SHA-512:9472D041818B9AECC9E32058649ABAA4C903BCA3162CB031707E4033D90058D4A123A783015146B20DDB507AFD1230F0ACF8F5C273C96353274162E3DC00FFB5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................0.wE.u......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t...............................................................................................................O._.T.S.h.Q.T.C.a.t.z.h.7.h.G.M.L.O.z.0.u.+.o.V.i.A.=.=.........:.......................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6AC20486-E1DC-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5632
                                                                                                                                                                                                    Entropy (8bit):2.213056144177835
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:rGGDTUxB9lj8AZyW0bKvqy6yEyvy5DlsN5Acb9lj8AZyWXvqy:rGG/UxZ8AZNoKS9LYu0OU8AZNXS
                                                                                                                                                                                                    MD5:AA49B33E3B061CDB5D332AAFF82A3AFF
                                                                                                                                                                                                    SHA1:39FA990E38662F36930BB3B9E0E56DF9BF3DE5E3
                                                                                                                                                                                                    SHA-256:BEA556999638656C2524AC08005CA8597280CC17911CE9AE6E774CAE0AB8C0E6
                                                                                                                                                                                                    SHA-512:1EA8F4AEED20DFC281923CE30A7E14B860AD01527E9D0B15580CAA87B29FC287FD3C13C7B5113148EAAACE86148E921031FE1DAB31B3FB63E864F6DDF1C4B0ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................p.6.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6AC20488-E1DC-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5632
                                                                                                                                                                                                    Entropy (8bit):2.2123389440716883
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:rvGDIRH79lj8QZyxuKvqy6yEyvy5DlsNUAcb9lj8QZyxXvqy:rvG8RX8QZWuKS9LYu09U8QZWXS
                                                                                                                                                                                                    MD5:E220030737FE252079B137ABE8DDCC4E
                                                                                                                                                                                                    SHA1:EA22C522B4764302F1D444894A7D94ED0C4BFC38
                                                                                                                                                                                                    SHA-256:DC00B083FE08DB95A1C25C973DDF938878F7946804148693806B9ACA9E1E326B
                                                                                                                                                                                                    SHA-512:825242EBE09629D31A3D2F5ED2AC016B90BCC3522F2AFA880E60189FCAFE86F61B703E8F0B1CEB275877407AFDCAB738D5A7D53CF53800F3C154D291F9B4DFF4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................@Q.7.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{72970081-E1DC-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5632
                                                                                                                                                                                                    Entropy (8bit):2.2125293875642096
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:rAPGDyRH79lj87Zy6uKvqy6yEyvy5DlsNUAcb9lj87Zy6Xvqy:rwGuRX87ZNuKS9LYu09U87ZNXS
                                                                                                                                                                                                    MD5:E9E442D2491CA52280D8FE09B80983BA
                                                                                                                                                                                                    SHA1:9DD6A29EC16823074C0D108CA3CF97EC9398A522
                                                                                                                                                                                                    SHA-256:A07B97A4CC8706BAC10C6DC25A78C995D4336BC38750223CE3DF7FBB4479B93E
                                                                                                                                                                                                    SHA-512:A2656CB0FBAB37FA0E90775E37D3A939F4DDD4DEFCDE06CCB3AD050CBA45C9B4375C4A531A1C3C7E115B17CB3E6EEF31BF1873D0125ADE6CF6BE2E8F2F13410A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................0.`6.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{72970083-E1DC-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5632
                                                                                                                                                                                                    Entropy (8bit):2.1996581542110336
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:rIGDGURH79lj8YZyNuKvqy6yEyvy5DlsNUAcb9lj8YZyNXvqy:rIGqURX8YZ6uKS9LYu09U8YZ6XS
                                                                                                                                                                                                    MD5:B15BB208556ACA315566FC8E4A56EC02
                                                                                                                                                                                                    SHA1:C05733238B26A70DBC6467298F7C2EA8CE0B44D1
                                                                                                                                                                                                    SHA-256:279D403F21C307A0AF0103D9BBC1D3FEBCF7B08AD60B0C6DD8D158385B0F4FD9
                                                                                                                                                                                                    SHA-512:0F89E69E018DD0C124697567D7294DDBBDE1171E6692A7692ED60FEF636CA13BE78EE0AB1D3AB4E3FE6348D60E4D2A97570BA5D89F3394C55A6D89436721F168
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y............................................................................................:.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{82FFDACA-E1DC-11EE-8C2C-ECF4BBEA1588}.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5632
                                                                                                                                                                                                    Entropy (8bit):2.203912692781547
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:rpGDvRH79lj80ZyVuKvqy6yEyvy5DlsNUAcb9lj80ZyVXvqy:rpGDRX80ZCuKS9LYu09U80ZCXS
                                                                                                                                                                                                    MD5:E651380A9D99DE8CAE75992D5EB23B90
                                                                                                                                                                                                    SHA1:7DAC6C53149CCB082AEA01B94F0523ADD5A7D9AB
                                                                                                                                                                                                    SHA-256:9D472F95966760AC17EAEBA9399772F3BFD531FCC35B9BE74CA1E69EF6FE9DC0
                                                                                                                                                                                                    SHA-512:DC553C733A78DDEEC682D146FD837D1EE7BA397FA7DBEF89D13736BA9E090A32303C3C234DAA041348774E6344E15C3F90AE26068E4C52C9027B4F1D94992102
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y........................................................................................../.F.u................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):355
                                                                                                                                                                                                    Entropy (8bit):5.071081258705978
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc41ETk2BisDAj5kNTD90/QL3WIZK0QhPPwGVDHkEtMjwu:TMHdNMNxOEAmii2anWimI00OYGVbkEty
                                                                                                                                                                                                    MD5:20888279FC12637BCBB8B8FA76BE9886
                                                                                                                                                                                                    SHA1:90705A14886C8EFB632AE6BE97EB3FC2538418CA
                                                                                                                                                                                                    SHA-256:DE54C96A5B4A390B8F2009C34F7945422DF96E71F5A9FB6618C466378EAE55CC
                                                                                                                                                                                                    SHA-512:4F1B5C5CA2A0DACCC42F6415D21F7BAAEBDBFB029CE71E76275C3AD936FD3E838906ECD657145A86A2093C12BB527535D11EE4AE90B778987A25A0ED60CD7F72
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x37777edd,0x01da75e9</date><accdate>0x3779efe0,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):353
                                                                                                                                                                                                    Entropy (8bit):5.166378092393153
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4fLGTk+SOuiiGikNTD90/QL3WIZK0QhPPwGkI5kU5EtMjwu:TMHdNMNxe2k+YiiGianWimI00OYGkakU
                                                                                                                                                                                                    MD5:35AC49E813082E9E8E647ADA32B0157F
                                                                                                                                                                                                    SHA1:C8B949C124043B5E321DACC37FB7EB6E3B79C4A4
                                                                                                                                                                                                    SHA-256:CA73C1E89B4AF8DF1188FC239C41E25065E09C17045B263EC710A2BC57A7CF1F
                                                                                                                                                                                                    SHA-512:214E3963BEB57808F4D634337A8A1A1DFE5E5DEFD97EE40C95B22CEA20A1CD448A19171F86DD9D5016A9C37D1CC535E2669B31E0CF0D9C7CA130C7F8F78A8A2B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x36f897cd,0x01da75e9</date><accdate>0x36fb08b4,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (317), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):359
                                                                                                                                                                                                    Entropy (8bit):5.1241793861600256
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4GLu5t5kNTD90/QL3WIZK0QhPPwGyhBcEEtMjwu:TMHdNMNxvLu5t5anWimI00OYGmZEtMb
                                                                                                                                                                                                    MD5:A0017F7641EFBCE247E25E5A5D05EA82
                                                                                                                                                                                                    SHA1:E05A94E9C98CB4AD9E1753FE1A59DD7E6FD5B2D5
                                                                                                                                                                                                    SHA-256:3CA8A2741C78FD8FA1361978C22407345A3B17D2D8A6E63587ECC7A78A5E2865
                                                                                                                                                                                                    SHA-512:FF7F0F53DFFC92A0B92DF190A147E26496B68DDEB35960293B6683BB47FC1991C8673A2CCBB9C1BF786CCACCC88B9AA2DDF2B410D813D17FFCC5A1B04B5D9407
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x377c60d8,0x01da75e9</date><accdate>0x377c60d8,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (334), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):376
                                                                                                                                                                                                    Entropy (8bit):5.190740919432917
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltq08eDPOOKaihMabikNTD90/QL3WIZK0QhPPwGcE5EtMjwu:TMHdNMNxtDPOOKaKGanWimI00OYGcE5t
                                                                                                                                                                                                    MD5:8737062301245FD0339AC8F149B7C337
                                                                                                                                                                                                    SHA1:40ACD52BBAB11C1590DD36A994CEE4C6C51E219A
                                                                                                                                                                                                    SHA-256:7ACE96D18A02455602CAC77A1ADBD97F6BE634EFC5F7F5F82DA73E0CCA587DA1
                                                                                                                                                                                                    SHA-512:D7AC6A7760DF5DEF76CA97A239D0BF7C715E04D6C8B7FB4B34F58AB404AAF3AF3B358B70C4964F6234CD44E37AF517E28F92710F11E05BA8D2F827A947D6D837
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://go.microsoft.com/fwlink/p/?LinkId=255142"/><date>0x371101ca,0x01da75e9</date><accdate>0x371854b9,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Bing.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (307), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):349
                                                                                                                                                                                                    Entropy (8bit):5.130721085293764
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4J17BiO13JkNTD90/QL3WIZK0QhPPwGgE5EtMjwu:TMHdNMNxi1Fig5anWimI00OYGd5EtMb
                                                                                                                                                                                                    MD5:3F059DCD0DD78B69770582D15400F672
                                                                                                                                                                                                    SHA1:1BA9B8AA98CDEB0ADAB873A6C50F0A81DDB1BE5A
                                                                                                                                                                                                    SHA-256:A74279954AFAA8FC064AB91A0292CE1BA54E70B77514B071A670769139AE1D21
                                                                                                                                                                                                    SHA-512:28FE2F2DE8AB2137AF1247A167056B0FB4CFD0ED60084B162C6083E82838729969728B5095C0804EA26D17D305E3FA72EB73B6346048A1050A755A9A31DDA5C6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x372cd6af,0x01da75e9</date><accdate>0x373404ae,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):355
                                                                                                                                                                                                    Entropy (8bit):5.148773656750066
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4UxGwrOBiEOBikNTD90/QL3WIZK0QhPPwG8K0QU5EtMjwu:TMHdNMNxhGwruiEuianWimI00OYG8K0z
                                                                                                                                                                                                    MD5:3EC97EE74EDFD6617B03D08DA53BAA3E
                                                                                                                                                                                                    SHA1:468FBD76230DCA4F8421EFF3FDBD1AFBC853DEFF
                                                                                                                                                                                                    SHA-256:673282C82BCB3798B7C015BF785012E21398FF5999D9E522063CF440E22EBF24
                                                                                                                                                                                                    SHA-512:90AD6089C78DD940D98249A043EE5EE332692DFCA5A4822079F2140ED04E7AB93E4287C8A1148A6998D5B97C4ACABD64D7E206A55E495B4984DB3DC7423C0A46
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x377ed216,0x01da75e9</date><accdate>0x377ed216,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):353
                                                                                                                                                                                                    Entropy (8bit):5.071821144843265
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4QunPwk2BikNTD90/QL3WIZK0QhPPwGAkEtMjwu:TMHdNMNx0nPLmianWimI00OYGxEtMb
                                                                                                                                                                                                    MD5:56A5D876286AF2966F9D64482223DFA5
                                                                                                                                                                                                    SHA1:47A33686F0E81269A57DE63B803BCB29A8936C0F
                                                                                                                                                                                                    SHA-256:21BB553898D5EA313CE43F3128FF4348A8F3B34D3E767CB57FB1FE9332C1923A
                                                                                                                                                                                                    SHA-512:8958AAFBE98A5ED755BF982227CA5C2BD9610873B17C9DB79479E55F824F278785DD03DAB5E879497224DB87C306094F76C2115F5178D5D4A6ECF3BC6A2D666C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x37750dda,0x01da75e9</date><accdate>0x37777edd,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):355
                                                                                                                                                                                                    Entropy (8bit):5.166547540754169
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4oTIn5PHgskNTD90/QL3WIZK0QhPPwG6Kq5EtMjwu:TMHdNMNxxO5/nanWimI00OYG6Kq5EtMb
                                                                                                                                                                                                    MD5:0F42B58EC4249FA12B498D32805AA671
                                                                                                                                                                                                    SHA1:CD6F99B99D6D212BB0B97391C0AF2EF95D40B781
                                                                                                                                                                                                    SHA-256:C679FAE9BC21C35B074336FEE29CF604444AD0A4ECECE7DB0A1BF6F4DF724DD1
                                                                                                                                                                                                    SHA-512:9D70E63ECCCA7C155BE513A0A982653E4EBE28BBE5C05D61CA18810B5C9CF8D42646B15488458F9A746B605BED1F19F655AE5AB2ECC6C0F409C56E6BEDC5F0BC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x37666163,0x01da75e9</date><accdate>0x376dbacb,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (315), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):357
                                                                                                                                                                                                    Entropy (8bit):5.137888060228208
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4YX2n3l7MnkNTD90/QL3WIZK0QhPPwG02CqEtMjwu:TMHdNMNxcpMnanWimI00OYGVEtMb
                                                                                                                                                                                                    MD5:5B599EEEAED4218EDE17BFC496F5B395
                                                                                                                                                                                                    SHA1:7AEE274858991F447A47687128FB2415EE964A5F
                                                                                                                                                                                                    SHA-256:DA0B99EB24133662A0A2DA60DDFB1811470CB9250AE068AFC0981F776483D17F
                                                                                                                                                                                                    SHA-512:7AB65D05915BCB9EACDEF79EDFCCE5BCAEAFF21FD25045504E1C5902C9D63F27B26E8AF0ADC0457D87EE00FD3DC8BB3A65858DB19C3D2F6E7845862A7B0A6070
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x371f6e9b,0x01da75e9</date><accdate>0x3723bc21,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):353
                                                                                                                                                                                                    Entropy (8bit):5.119262960013618
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:TMVBdc9EMdLD5Ltqc4InY4iZFkNTD90/QL3WIZK0QhPPwGiwE5EtMjwu:TMHdNMNxfnXibanWimI00OYGe5EtMb
                                                                                                                                                                                                    MD5:577BFDBD578CCAA198584AA69FA19CD3
                                                                                                                                                                                                    SHA1:B0722CB5F8F536BCE3709C82BC76A5310A60B051
                                                                                                                                                                                                    SHA-256:D180E4EC23460DE3E985D956CB6253B87CDDA4A4AAFCFD1BA670F83188DC569E
                                                                                                                                                                                                    SHA-512:53960838E73FDFBF374CFB87CAF4240DFEE9E3F273DC35CAD9A9DFFD4AB1FB0CAFEDA2B50B55956A896C61A782CDA5E1F62497378115C2ED9D81E50D9FA72828
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x37262d0d,0x01da75e9</date><accdate>0x37280200,0x01da75e9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\6ocxx62\imagestore.dat

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):866
                                                                                                                                                                                                    Entropy (8bit):7.17711378242431
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:kUvF/6easyD/iCHLSWWqyCoTTdTc+yhaX4b9upGt4:kUt/6symC+PTCq5TcBUX4b8
                                                                                                                                                                                                    MD5:748945F5B4F207FC7E408F17456B6BCD
                                                                                                                                                                                                    SHA1:7245058F41B9331CC633B0E9AEF2C44FE6840B62
                                                                                                                                                                                                    SHA-256:C8D2114FD8C897ABA4D5EC324AB4B7EEB147BE2D3FDA7339739D946408CB2869
                                                                                                                                                                                                    SHA-512:3280C4310C5C1669C8E5368DB3DF5CF9A30A465A867F701E0A3834EFF5239F3EC74D61D382A08EFCD476833CEADAA2FA53F6DA3A035CDB710D1B87650C0D5273
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:..........h.t.t.p.s.:././.w.w.w...m.s.n...c.o.m./.f.a.v.i.c.o.n...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`. ... ..............e.......e....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2278
                                                                                                                                                                                                    Entropy (8bit):3.842896936689249
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:uiTrlKxrgxyxl9Il8u7ryg3HWPSwisqrPqBd1rc:mbY0g3HWP9iLPqi
                                                                                                                                                                                                    MD5:FB3E09EE26011DA2D2A0FBAD0964732E
                                                                                                                                                                                                    SHA1:7736AAEBDBFF25FE8BD55E7D217B531218BE616A
                                                                                                                                                                                                    SHA-256:9F743D78FA8CB2DBFF19F1B292594E414A00C4F3D3682AF142909D7306ED7979
                                                                                                                                                                                                    SHA-512:2D815A46BB1ADF39072F047E01F46086EB710A4EB4275BE65602C8FEF8F190DA22A86F1A8A49D9FAEF1E58919256EDACBF35B28A53DE4D3FB3DFBB1B9C9CA999
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.F.V.R.k./.F.1.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.B.L.S.B.N.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4622
                                                                                                                                                                                                    Entropy (8bit):3.998190214679956
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:uiTrlKxExUbxD9Il8u7ryTA906JfhKxQ2MWnWgoH7efiVr/skD53A254nd6EEH3W:qY0T404CQp+1obefW5Am4nYX/emq2/o
                                                                                                                                                                                                    MD5:7DB1A9F6900FAAB32341C4908171B874
                                                                                                                                                                                                    SHA1:0F21122C6795C02FB932D6327DCBF4C8570AC490
                                                                                                                                                                                                    SHA-256:2935A20A6FC7054511ED702A84DCA9460701AB4B69A9200D11E87EA3B2ADB8AF
                                                                                                                                                                                                    SHA-512:00137AAE8AC6A303A5E748EA06FA968361F26B80A68A48CA695E1076A99866C3E5C4F0FE04431004DCFF1AE6C5D23BF2CAA72B5B52D8C3437BA17A527C3FB1D1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.M.z.0.e.O.l.1.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.B.L.S.B.N.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\favicon[1].ico

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                                    Entropy (8bit):3.8046022951415335
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                                                                                                                                    MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                                                                                                                                    SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                                                                                                                                    SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                                                                                                                                    SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\favicon[1].ico

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):758
                                                                                                                                                                                                    Entropy (8bit):7.432323547387593
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
                                                                                                                                                                                                    MD5:84CC977D0EB148166481B01D8418E375
                                                                                                                                                                                                    SHA1:00E2461BCD67D7BA511DB230415000AEFBD30D2D
                                                                                                                                                                                                    SHA-256:BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
                                                                                                                                                                                                    SHA-512:F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\AA15Yat4[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2013
                                                                                                                                                                                                    Entropy (8bit):7.81099098044133
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:qcPmqB8c1a5ShKNuK/z3amAq5zGQy7EFUQ9:J178ohKNuK/zLwQ9WQ9
                                                                                                                                                                                                    MD5:1F3C2A6537F6260FE81A7CBFF4BC431C
                                                                                                                                                                                                    SHA1:E779F157168D274F1FAB870C85349C9A9F9466CA
                                                                                                                                                                                                    SHA-256:31D6A3E91B525A985991C7B179331B814C77B54193D22E594B09018FD7AA5637
                                                                                                                                                                                                    SHA-512:A3004D5701D6E88D35B5F946A26D0C893D681E9F8651C7E0F0996CA85048685C37197BE975C8E9AF3825F77A5582ECEB246687851EA221837770A8DF257DE599
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....sRGB.........gAMA......a.....pHYs...#...#.x.?v...rIDATx^..K._.........n...h..._.T...c...>h.J.OD....c.]....[..4."".B....`..^..~'.>3{.......,.k..3...g....,....CX..c.0...0V..X..c.0...0V..X..c.0...0V..X..c.0...0V..d..vy..)....-j.\..V.^M^x.].._.|!/<...0u.T.={6,Z..f...D.>..........l.......b..i.QM..l..9z.....E.-.Y....Q...,//....^.-.F..............h.@..g....V...SO..+.<.>}.s...'.L....]....3.ah...l.....=.:w....q..}...'/..}.6TUU..OiK0Z..........fNQ.0..oa.....+....D..f..eT...L..T...t~..AG...3 j...0.....r.G..A[[.y>......X:..Xgg'..'.3............m.pww..*.c....E-.eee...3..Y.l.444../.}sg!..;w..'...#G.@ss3y.\.4...6..X...3.0u.b``.9v.;.e}....z..E.....aH...O.<q..'....l....r..i...K.....\,.p....I[....Z...(...w/v..u.`.}.!f...,..E,.....L\.....PK.._S+...p.O~~>.....%KhK0q.CHEE.........,...aj9g.....c.***...~)l$...g...O..q.CX#p.7n...$.'..<..]..D:.U.[.z..9..6m...$...`..p.B....7.T.[..|.2..X.`....-@..... Na..wp..I....!.$`5....ni..FW

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\AA1elCIp[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                                                    Entropy (8bit):7.425488218397858
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:6/Xvb6/5E16KgNqt2vQ4Fg7A6+ttvnHMk:6/sW1+UtSNFg7V4tvnH
                                                                                                                                                                                                    MD5:35B80C382499C72375758E647B791BB0
                                                                                                                                                                                                    SHA1:EA4EA6C96FBFFD517EC2A79105F4A23F08E8C883
                                                                                                                                                                                                    SHA-256:AA3D754F75F3B9153D6240361CD8A3D6A19C28251A639915FC5AA898D062D212
                                                                                                                                                                                                    SHA-512:EE525B1C0554E0FA640AAF571F36F8B304F8669C533F5F2445E4F9A472BE1F225EAA0D750539DA09EE4EFC91801D43DAD03E38AFB9D745FBD230A5D0BCA14321
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`................................................................................................................................................,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.. ...;.Z..n..\.]............4]w..o....e.....4]w...:?...?.&?.u...M6.../-n$.vE2......;!=..(.Gy1c..F...."$.#..........4].l..V..4...1v...$...+.2..<.?.1h........K.=...?...1i.Q{.......|A.x.....>G.4s........~..i_O.G.4s.......x.J./#...9..,.85.:.....X.]."H.Y}A."....oM.}k...W.h.....3...B..#...A..|l....K.......G..M....v........Q].x..c..,...s....4..~.~.....mj..fH.#.#....IV.........J.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\AA1foEAu[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):404
                                                                                                                                                                                                    Entropy (8bit):7.083170614146936
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:6v/lhPkR/C+hdv8XNJ9x8LfTVWsiqv4nm0Wp1ksmzZrhf3blFyhZN/Wx1L24f3/N:6v/78/NdvE38TTiqZAf1tf3ehDWzL28N
                                                                                                                                                                                                    MD5:483689E8662907AEE349A4659E908FDB
                                                                                                                                                                                                    SHA1:DC25F02AE77A4BFC7890EA287E38C29A8F5F5BE4
                                                                                                                                                                                                    SHA-256:E9A8B40FD14B1015D49A21E2BC838164FB80F48A6945A98253F6F82D8D3F18D8
                                                                                                                                                                                                    SHA-512:38BA0361A81A7E1FA9A1369815DB403C3BB8675217A0C4B3E05ABDB3CAF3E9D0F9ED0C8026816A3DC6164697C0C2002C6C05E520A1EAB61FA3E6A6AD3FC1E75A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...)IDAT8O.....`...h1.... Xday..=8.v...A.Av..`.,.XE0h....A0.......~..............<.. `.Za.^C.$,....H...?.~.GUU.........q...8....N.m..!...y...a..=..a.\N[3.........mF.t...I...{.,{+..L.4M.V.%PU.M..IQ..^.d.Q.8..4..t....`DQ....<.Q.5.a ..u.e.6.....j..,_....>..v;..Gj7...|>.......m.q.S......A.ej7...../....y/....IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\AA1i0jET[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                                    Entropy (8bit):6.12073557077176
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:6XKtsiv3+38JKJgO7ezsqWP0Eu59xW+1s7dYKoH6Q5R2B/z:6QF+38JKJgO7eg/0V598Gs7d8H6bBr
                                                                                                                                                                                                    MD5:960818F2CEBB5AEF0F5D62D04CB3163F
                                                                                                                                                                                                    SHA1:FCE62F6C124F54F389024D6C1A524F64D2B9C7FD
                                                                                                                                                                                                    SHA-256:418D726E41CA7E1C85353CF96C95262FA858751B3778789E47BA3398169AA0C6
                                                                                                                                                                                                    SHA-512:E4B285ACF9F0E36FFD08701F1E7200AF425B90B253FA02949A65C855AE59F5F2475735CF5B240316E13C764B44AB1EF267F1F19846FC87D6BBDA7CE6F12E4A34
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`................................................................................................................................................,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...._.4...1......._.O.........*.jR}...X....z<g....B.O~?..c8.te;.6.c.N.........*.+A~../..X7..M.e}..d.n+......5..w.I.'..8..sz.)4`_A.NY.t..sn....6.,t.).K.@..p.+...u..}.N...>"Y.../+\\,.HH...Z.;-...5..<.V'..G!.4...:.......F......>o....^pqg.Nv..W.<Kq.....F~.j.....a....P.^}k.ET....F.R..tw..5wI..L...P..o.ka.;...If.g'..X..i.W.]ENSW..l...Al..n....e......$dm`3.v.r...W.^..v%...

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\AAEyR6E[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):673
                                                                                                                                                                                                    Entropy (8bit):7.615587910313665
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:6v/7ImefM9ybzcohquCjr6zkDLmQ2Fg6GDKIt3IeT90dPcDeyXXGTYUk98R4XN:5mekUfHhYXmpxGuIF1udUDtmTjQ
                                                                                                                                                                                                    MD5:07987C39CCBE8222C659E3594D42463B
                                                                                                                                                                                                    SHA1:933B6536F1BC88DD506EADD7D68837E407F281E6
                                                                                                                                                                                                    SHA-256:E93F9983F3945E8A7EBB52276F619D8F58B8BCEF4C1B75D677331ED656799F41
                                                                                                                                                                                                    SHA-512:9CA066A0AD3BB5E0DD46745F4B1544520C3AD0347F59B1E77873C1DB5E7157526B6E13A88096DC71CAE7FC5FEE045A87BAF53F424D24579DED19432695551028
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a...hIDAT8.m.OHTQ....7ol.-%...2.6..B......j..Q..".6...].....j.."j...jS.H(...*hh..b*..7.....q.....|...w.'..%U.\.......}..`......p......m......gQ ...s .?*m..HP..y5..._...`./..z>.v...h.W4n_...C.C...<..i.Z.f1...&.......+./..q..q...o...K.....t.........4.5.d....)...4..B..z..&h..0r.....).....H..d-p.A........PK..4.h.;5@y.bg9....D.}A.!z..S..L...2...Q.......'3P.u<......7..0=3..\....|......H..oy..m.@>0.51.I...wp..;.%.8d^D..r.a.......}.@B...k.w.l......)..3.m....<X.&........o!......T....L.^......;@...._....a..TW.8...O......[..8.}.."v....4..C..@.v..Y..X\.VL...B%^.b...Q..p..K.K..B....{.}..$.!./..J'........V....IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\AAPZ3U2[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6630
                                                                                                                                                                                                    Entropy (8bit):7.9537236099118696
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:CSWvHqMVv13qmraixCBnHaL50czYc54Jr7LLcz:dCqq9qmaixQnHaL5z0mer7LLi
                                                                                                                                                                                                    MD5:93011BFCE422DA1B687766D7F67784DB
                                                                                                                                                                                                    SHA1:220256C98AE1A8D73690B9A62A7AE908781F71FE
                                                                                                                                                                                                    SHA-256:D3412A156F0B424627402E8554C564A1843A0B47A81D7C6703A320EB230B6FC3
                                                                                                                                                                                                    SHA-512:E51C4F9CE5EDB31DF0AD66D3453057D06498606DC3E8C8FE1DD57730CE8EB591D0B1338CA981024602D704B7C25D4C4B638D5DD6B8DB54C1795AB7695E4CA294
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a....{IDATx.....$E...B..8.9w.S..www.Np.@p.............O...dvafwy.2.....U.[.N...Q..L.F..0J.>.(......3....0J.>.(......3...x....3.<..............K.>.l.....x.............../.C.=4m..F.......8....W\.^{.4....O....v.t....u.Y'.....#.H..sO............~...s.I..._.[o..&4...p..o..<..4...;.3.|.............~.U.L:....f..w.S.1.A...N._....D.M.W[m.\.=.u.Q.+_.......~..|.G.W^y%O..s....;....O ~.y.+w.._L{.g....g>..._.2.......C..P..........^...{.4....O}.S...._.b.)..^....?........hUC.5...}.c..+....,....j......i.I&....'?9,..x.t.7...^;.}....u.].6.lS.~..'.A..T...B.1.x.....~K.O9....u.]y...<..c.W5/......5...]v.%?...C>w.....3...a..^8.:...3..........?...C[..u}(..."..{...m.]......_.......?..O...N.E..7.|.>......(/....7..M..-..W.).%..k_..3.......^.3.4S...ik..F.>~.>..J....z.J..|....?.i..k^f.er......W....r.\lL.A\../}.K..;.>.......J....\TQ.v ...........l.Y?..+".P.(.<O5.T-D#.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\AAywOab[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18737
                                                                                                                                                                                                    Entropy (8bit):3.2627728137161602
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmHjxNXrNXNsc5MVNkvBs6c3:bSDS0tKg9E05TKk615UNa7G
                                                                                                                                                                                                    MD5:030939BCC37975289457F6A19A301A35
                                                                                                                                                                                                    SHA1:89D55A45787FE9DD547BE9CD1D97C9A8F641E338
                                                                                                                                                                                                    SHA-256:D5D6DF229AC67CDE4B39D275955E4A279BBD7F922855D10B44F5701E6AA3CC64
                                                                                                                                                                                                    SHA-512:21973881EF4C8EE777A1EA5570418439DB32EEF3B83B1FE468749B5C7669B82B19DF6568531C0155ABA929A2928E88DCDB654E1DE8F3966228C279E91C120E9E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\XOY94AMV.htm

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (58855), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):190493
                                                                                                                                                                                                    Entropy (8bit):5.461115289047456
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2y1CzNFD4LWDoRLk/h5NyhwNuORAK/xYU:2YC34L3RLk/NyhEuN4xYU
                                                                                                                                                                                                    MD5:6674E3B23CD8B8E1E3722786921663A5
                                                                                                                                                                                                    SHA1:1E175A90A3ADDC786E49A5A76D08C59D32B6A8F6
                                                                                                                                                                                                    SHA-256:96BB27C0ADED478C7F0C39592574D0DB405CDBF939A8A828F5DD20FEAE1C7754
                                                                                                                                                                                                    SHA-512:FD3BE9BA195660B3B1C942CBFE8512B00FFA08895EAA3F49D4A5B22E2A1C2B730CDF2A38299AE2E3835079B57DFD5B1C41AB34CAEB8EEB8C62FC753E40D60EDB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,prg-visser,shp-xap-gr-noux,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,prg-1sw-sa-uiehacv2-ctally,prg-1sw-sa-qryan4t7,prg-1sw-p1size-i-c,prg-1sw-p1w-c,prg-cg-rr,1s-eaop1,prg-sh-badgewc,prg-fin-hl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-pbknc,prg-1sw-sap13nbrnc,prg-cg-uxprod,btie-brandsft-c,btie-aimclickbait-c,prg-mscl-hld,prg-msclck-rf,1s-fcrypt,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvc,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-iprc,prg-ctr-pnpc,prg-upsaip-w1-t,prg-upsaip-r-t,1s-rpssecautht,jj_fac_t,prg-pr2-cbdgendpt,prg-ad-article-h,prg-1cashback-astrov5-t,prg-1sw-shipfin,prg-1sw-enableact,prg-1sw-fnccombo,prg-2cashback-astrov5-t,1s-wpo-batchuup-tt,1s-wpo-batchuup,1s-wpo-pr2-ptasks,prg-ad-rpwns,1s-defaultscn,prg-1sw-pde0,1s-defaultscnw,prg-1sw-tbrcounter,1s-notifmapping,prg-sh-frnrc,prg-1sw-spnot2,p

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\ast[1].js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):125250
                                                                                                                                                                                                    Entropy (8bit):5.366459254148267
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:QY0mqjfSB5TUVJTwzIYo4c/tJX+QiKCWczYxreKan5CPO4a8+DHAizsjqLZ7Ea7l:Ata5T+0K4KaQiNuF24AdsWLZ/7l
                                                                                                                                                                                                    MD5:4851F99F7147D56FB954D81055CA2D3D
                                                                                                                                                                                                    SHA1:8D7982E0B6329C0460F0EE61CCA0151181326F2B
                                                                                                                                                                                                    SHA-256:97711CF6D03D55D6DFA7BA68473B2D0D3C64C963463100F87F6792A4D0D080C1
                                                                                                                                                                                                    SHA-512:21F2B58E5FAAF45A80D5E472901A430F3FE49286694991E303939D1280716885F4A31C422411843B02A9CE9F409A8042E0A39320A4CAF0FF1F114870D581F7E8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:/*! AST v0.61.2 Updated: 2024-02-13 */!function(e){var t={};function n(a){if(t[a])return t[a].exports;var r=t[a]={i:a,l:!1,exports:{}};return e[a].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,a){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:a})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var a=Object.create(null);if(n.r(a),Object.defineProperty(a,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)n.d(a,r,function(t){return e[t]}.bind(null,r));return a},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=12)}([function(e){e.exports=JSON.parse('{"o":{"UT_IFRAM

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\jquery-3.6.3.min[1].js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (65447)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):89947
                                                                                                                                                                                                    Entropy (8bit):5.290839266829335
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:ENjxXU9rnxD9o5EZxkMVC6YLtg7HtDuU3zh8cmnPMEgWzJvBQUmkm4M5gPtcNRQK:EcqmCU3zhINzfmR4lb3e34UQ47GKL
                                                                                                                                                                                                    MD5:CF2FBBF84281D9ECBFFB4993203D543B
                                                                                                                                                                                                    SHA1:832A6A4E86DAF38B1975D705C5DE5D9E5F5844BC
                                                                                                                                                                                                    SHA-256:A6F3F0FAEA4B3D48E03176341BEF0ED3151FFBF226D4C6635F1C6039C0500575
                                                                                                                                                                                                    SHA-512:493A1FE319B5C2091F9BB85E5AA149567E7C1E6DC4B52DF55C569A81A6BC54C45E097024427259FA3132F0F082FE24F5F1D172F7959C131347153A8BCA9EF679
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:/*! jQuery v3.6.3 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\me[1].json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):108530
                                                                                                                                                                                                    Entropy (8bit):5.320366393735626
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:eflHPjBoLlLc2+5X8YcqJgDOSH2kR3qoS/FH7JAMnPj5rxdY3GA2J+qTzbHSZ2IU:eVddJVhckbHmcLwAMu
                                                                                                                                                                                                    MD5:8EF5A2F8FF9750869C60E39A0B6262D2
                                                                                                                                                                                                    SHA1:E2662956FF77AB1B9367B42966A98F21C5F36480
                                                                                                                                                                                                    SHA-256:62F765CD44802224A8E7036BB43D67360FCC480625D7AFB33FB7825A41AFE5C4
                                                                                                                                                                                                    SHA-512:F481DDF12EB7048294053594A3E78415B1454C0B5A87FD34861AB05BB3A15255F86245F4CA32E069EE825CF40AAFB59E919C70242B2EB28D684DE45DE9F66402
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=ce0019b2-fae5-4463-81d4-f0a4ce1afe19&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1jPGel","type":"article","title":"What special counsel Robert Hur claimed about Beau Biden . and what transcript actually shows","abstract":"The transcript of special counsel Robert Hur's interview with Joe Biden details a more nuanced conversation than either side has acknowledged.","readTimeMin":5,"url":"https://www.usatoday.com/story/news/politics/2024/03/13/hur-transcript-joe-biden-beau-biden-death/72955917007/","locale":"en-us","financeMetadata":{"stocks":[],"sentimentRatings"

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):29372
                                                                                                                                                                                                    Entropy (8bit):7.962946515897512
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:SXNQN1pByTjBpTRSnqXCO2dl36gq/ubyB:SXcyTtpMAy3auuB
                                                                                                                                                                                                    MD5:73BE42764C161A700C00109E1A25AC50
                                                                                                                                                                                                    SHA1:386E7935F80EF135F09DFCF78B4C7766E2F4DD29
                                                                                                                                                                                                    SHA-256:8C020A30BB62C22B63610804C5ABF70B05D93EBA5790A8DD37F505AC598EC8C4
                                                                                                                                                                                                    SHA-512:3F762DF38436292BB385C62EF0DA0D0892D5BA0DFEABCE5D2AE2C7932E5AC7FDD47DA155F03DB60270207C0B238895F42C2693FD04900B8F2B52ADEF227D7175
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..6o..4{...v-a..K..!X.`......~.km..)it.m...%@s....C..;f......:..!..0....\.....=.v.Z..E.]..H.8t..m..B.6....j....X..tM_.l.-..T`0..We........4..fk.I-.=..NEr.}....u.%ToW".x.CM........!h..A.....K.ad.&.b.|y.%...i.QI...+...g..J%T\..p.79..mx...+.5.?...8l.Q......h!.$.2..2k....Y-......X/.$....(...........).'.....I....F.......+..G.5..G~.*.$.l.~,i........k.&

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[2].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9204
                                                                                                                                                                                                    Entropy (8bit):7.8303840467666985
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SrjYAtgE7xuFbbQhPOH0ULGSFG8mBcKD7823AbCcYfyo5SORNO:SrUA32nVCKGDSL2Q+csBO
                                                                                                                                                                                                    MD5:AB3C8267D6DCC14997728C8315F63807
                                                                                                                                                                                                    SHA1:7679340446FBBA14286D9E1E593DC4E76E019EF9
                                                                                                                                                                                                    SHA-256:E2B6A1E5ABAFA7ED0ACDC311827EF5E1C49FB88236DEC7B06A6C8F6A171C9E09
                                                                                                                                                                                                    SHA-512:170A45CA3227C8140BD9079DC5C66A7831F412B082C2105C637F78A529F3DD22FC6726D4A8C8BD188022783CDF65DEC5F04E6455CEFA35DFF5EDC39B4A28A5A7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..BP.a."..Z.@|.L..h..A..OPi.}h.1..s.R...M.3....m4m"..wz..h..........65.&...>.&...4.."......I8H..j..<2G.....(.,?...Z}.4..?...Z~...>...?.!......!l..I.J.Kt.....v:.y..jM....z..z..F.J.o..(.z.....9........xjF..R...4...|.s.R.......I..eM.|...).?.J6.V.s......?..n>...3...@.......>....K..&)q...Z..8...;~.....I.(.....T`...K..FG..&....~..t....u?.....;=.Y.F.....#.1....nv..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[3].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):46560
                                                                                                                                                                                                    Entropy (8bit):7.9624821191942265
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:RZdOym283vkiKkmnnuyFtW4bvFqsoXzMIkY42HeRhMwXoLkg9DOERyPRphSOn2hX:R+fkfFnnpPW4bvFqsOz1kR2+RXXHg0EZ
                                                                                                                                                                                                    MD5:9AE255DA128D7B32CAD84BC9AC9EC40A
                                                                                                                                                                                                    SHA1:3E83C706E0A461B787C26A10A8E54B1D0149875D
                                                                                                                                                                                                    SHA-256:1DD9A81C586709D0153FEE599B584F1639948AEB80CCB7D38B29A557B35F702C
                                                                                                                                                                                                    SHA-512:297A45B0EFE530F474E09CBB09B6E190B2F570DF9868F41EA9DE82322BD6760BE5693DC48997400E94972654E49A09675525C9A29D3934B5D6724124D35DA6FB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..>.H.[x.3..$..5._.[..ga.l..G.W..C...dV....^....v..t.FKo.'~..z.(.yt.+2..d>Z....+..W.Oiv}..\7..WF...3"...W_......b.nG9=.:.bU:3.I..e......^.......ve. ..<;.X].[h...;...E.ve..1......'#...Kq.._..../l.EY[.S.Z..B..'.KyK..#5:.2.1 .......+.+`\...z...V9DI....[iJ...GK./(...A..XF....njc..c..f..M.(..f.m<.WEun.z...a.S...F:.+jx..b.G4.{n...J.a.....~......+O...o3*......jk=8;...k

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[4].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):27990
                                                                                                                                                                                                    Entropy (8bit):7.9650944221404965
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:S9RYbDWI2KyizSlfSatWEshDtGurLo6/aSRhYj7LHLSreds9n49Hbffdkg5f9Qjc:SHAVyiz0KatgDPLPxg7qWsZybndkiWc
                                                                                                                                                                                                    MD5:FD39555F27CA037F111D52575F69E48D
                                                                                                                                                                                                    SHA1:AA5318FF0C5C24BA20DDEA9E2B022FEA87286537
                                                                                                                                                                                                    SHA-256:5392AF1D27AEBE6A5786822BBE78D39D2FFF1CBBDD1944ADCDA134A6C6CFE1FA
                                                                                                                                                                                                    SHA-512:A062F4BA50AA6983808E60345B68B72E1D8AB401281297787F22A4A1271AF0299CACE584BD61ED8FD91D3300A03AA20438BABA6AB9A5D8146B077011021B8376
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......2...".ol.1.%....>.}k....OF."..h..t..4s...GJ.9do.r....Ccc...X...?55..R..!O.gum.q..ywv.OL.4..o'...;..4.<...&>U4..npTz.....h.v......k{y/db.....K..=.....0...........|..Q..0.,x.....m.j....Ci..m.8...y.....t.I.,.....p3...9..2....db.w....D./...'..z....l.x?.Cv..o. .........5..[S].w,"...Q......k..}5..M....m%.K..`.F6........<...|.a.2.|o.j..[..@A.`........;[..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[5].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21557
                                                                                                                                                                                                    Entropy (8bit):7.96190377328396
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:StrOiXQCJl6oSo0tU2lkze3uqkr2I0gbUyxkbdH/V1+wI:StBQCj6zPuqUkJyuhVzI
                                                                                                                                                                                                    MD5:1B90D0E584A1375F19AEEA773454F75E
                                                                                                                                                                                                    SHA1:6AF5123E9E1D5BC17235EC4EC0BC72F44FB76C23
                                                                                                                                                                                                    SHA-256:1B4D4BDB259D942157C71A20E9E972CC7A81F66EACF403936EA8E60103F5E916
                                                                                                                                                                                                    SHA-512:99654CD055E4040081E17933A22386EBA7F8AB886AC06BC7C1211AF850F41EAE23C6F5CF66A9402CACBC35E798F4FA1C5F3B9C61F38A53F941650E37314EE91D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..>..:...-.N.R...e..b.AE.I..!....S.}..0.7..=T......L..+...o9.5.<Tk..V.......j.k}...q.[b....'.jK.....k.r.f.. ....U'.S5.,%...S[^...Y.izq.k.5.-5..(B....r..:rKs..u(.x..K...R..5.o.yr3}.:...k.+Q.S(...^i<s/..:1._....<.\.NJ.A....3b3....6.2Kt..Y<.......$....e...zq]...K...@...u=.....g{.x~w.9.a.........G.:O...=....\........%.._K/.|..%.e..#..s..rz.Mf.~...O..".....J.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[6].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11824
                                                                                                                                                                                                    Entropy (8bit):7.956405978443279
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SFkO0vHsZiViJB7PQaV2v/LM4vZ31KKucRpj8Ww9B2C9WTlLBYiO5YdeZX4JI:SFkjvzapPRAvzTvZ3E9cRp4b2CIYi3dA
                                                                                                                                                                                                    MD5:D94D0EA635F5451141CBA2FB5388FA5B
                                                                                                                                                                                                    SHA1:6DEA72122A0EEDF108E5AF2E1A13A25F4CF34959
                                                                                                                                                                                                    SHA-256:78B7F32D59ACB4AFC9FD0BE557FF5C605A6A206ABB0CC0D6D4A86E888885908A
                                                                                                                                                                                                    SHA-512:ABF6F4032CB09CF56A72A22E5B45CFE17B4D3821C7575B390844DC556D7A1E7EBDB1A80E4992D4CD7F225752336E8E59B15D86EEB19624999EBA7E6D8FE672FB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......Bk..mthf..M.$!..s.~@~u........]..?....^..Neoa...`~...k..X$xU..6...T..P..i.x.LIU....#.j.5,DP"pFz...Qn..Fz..:.Z.".qRc.......1..T.S...!.....N^.XC....c.....x....T.N3.E!.X.....x4.[...Xq.t..V..|5....-......c..n..0.\5..W...'.L(>...=+....E...G.....0l|9.]ab..._s0U.rX......_....].....r..N?..]N.n.z..M......u$L.....z......2b.......;...8...^]L.K..Z.QO.....;.....y...1.9.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[7].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20573
                                                                                                                                                                                                    Entropy (8bit):7.953000648629858
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:S5A29ZdYi7us4KsCPab3QTOUhakxuhgV7HxCxC3SS/W:SFBYiSrnC2QhaYJ7Hxpu
                                                                                                                                                                                                    MD5:D058B2D82CC126BBE0232A55E6740B3C
                                                                                                                                                                                                    SHA1:B9C0B61F327EE2AD94C9E89E8D14E4A59611230C
                                                                                                                                                                                                    SHA-256:FECE0574A3DDE9F56961DD6FA7A9DAFFE2CFC804153CC66621D756D93E8EFC06
                                                                                                                                                                                                    SHA-512:2772DFC6BBF890969C2B2F94214881B4E9ADF39454BB51C905069B95154C27C21A5A41DDF66322E1A4A30785A1AC73EA81F100756AAC8B4AD6E4DCDC26F033CB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......$V.r.._8...p-...|T...Q.....kY..x'].....B=.+.._.d..`IS.1..P.5U.C...".N..J.].ts<>bd.t.y.......[d!.F.r........N.......|.n...Z_"...X..gL....+.!..T..w...w.v..4{....]...:.....#N..-.}...#G.8P..8$p=@...M.....0..<..G.X..;w.C....;T...;g.?JX.-<DTf.2pwGg....>5j.......7..v"R%%..T.VE9.`t....=.3....Z...xv.;.N.Y#...+...9HpY....3\...../.n....a.../.u#7..}R..q..d.evQ.B.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\1FSMRYHM\th[8].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12300
                                                                                                                                                                                                    Entropy (8bit):7.947747826951558
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SMAub54Y18pYv0YcIfmyrSJd9+Tz7F0CWqXycqxs:SZKDnyI+mSJmTzeUMs
                                                                                                                                                                                                    MD5:CCB7509AF1030092F42A5D5F0BE0E1A3
                                                                                                                                                                                                    SHA1:D495D5AAD6E2CB239853CCC95024425A63710E98
                                                                                                                                                                                                    SHA-256:133DEEB576CA18E5CF42F2B90D4731E0B7CC5F2635EBF672AA3E4F8062221B30
                                                                                                                                                                                                    SHA-512:2C70ECD809FC8C1A9F400C65D78EF14999DEB6F38A682F55625FB6272D649ECCAA2AE2868C83F7CD309AA361FC15F6F2D86B7D06F6FA124B3D824B9DADAC2A25
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..X...X.u.SXE{..3.Ev.S%...\..Q....O..1.~.'b.......<....y...C.......u.*Rw<.L...}.......U.../..U.'..T.'#....I.G.8...P.4.H.S......b.Ac....^H.$?J.5Y^58.v.P}..4)j)+......'.[...Wi.'n9......Gn}+G....~v!OrkX.0gi..X...h.m......5..^.6....Z<.g...0..NA*.,:...5....z............|....Vt_.<?.}B;;.....K....`1.@ m88.MzT'8E..N&0....:......T}X.....UD..r.Q.@..V...]

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\AA12I8qo[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1287
                                                                                                                                                                                                    Entropy (8bit):7.753286328828527
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:Qkmkb13K52UTcyiUJlRq85hww6qJyPGbh166BaK23P:Qkm613KsE+oLDBrJyPGbD66d23P
                                                                                                                                                                                                    MD5:9B8059391E9315D157357A18A6A0191B
                                                                                                                                                                                                    SHA1:C466111C02D867C05CD522F2F362CFC23FA22B9C
                                                                                                                                                                                                    SHA-256:379BC8D28440A12EA8A540917610C7B6A2B865CDA7275285FF922D69CF46B5E7
                                                                                                                                                                                                    SHA-512:CB19000C7425C1CF8DDA9A8D10DC220D4961D34AD9B837E4DABF2C649D57223F0497D344671782E4F4782BDAD82B06CE702E27D67F2176168DA619985BAC5848
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`.....m..o....IDATx..]l.U..........MD.ra.h-.c....?.F.T....@..ik......6.......pC....x%....DJk.......x..-.......$.......w..U........ :R..)....@.b .1...HA.. .R..)....@.b .1P..P.<.,+.nB].p&H].rI....G...D..<..V...~;...z..w..?..%V.~c.z...B..=(.z._V.3.=\.)..-%......w1.]e..8.P7....kC.j.......nhT+.H..B4(..Zg..$J....I.W..:{..S....VC...74.....^,..6X.....8.jX.W.._.~E.....w. .....e..x...kB....z...3..?..m...z....d.......g.D....n...q;GNo.3N|...%.._V.i~.....!.@p.E.k.[.(..D.lW......$H..Q$A./Z....jz.K........-.G8A.B5....P........q..-.a.)..u.U.a."..../..4.Q..X.....{........$, . .....+)...^..+.U..fz. ...-$.....#n..j_..z.Pe..O....ts....w..B.........F7..(Zq1...{.q..w.._.,.Zk......T.H....,.<.h.g.>...........f......%7...l*T.&..ykrr:Vo.S...f....S..~#j..A1........C9I':.......t..NO.......,..b..e}g..I[c..7..Y...B/.@...8}.....!...7.b..N.c.......m.pz.E....8...... =p$..A..s.K.......M...B:...q..W.O.`...;....E.......{.P..... ......-.....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\AAM6NtS[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5612
                                                                                                                                                                                                    Entropy (8bit):7.9387712733341145
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:RdIKTeqSAumM6umYtRwqlRtBDz8AENFsAAP5zS5hVMISritBoocj/DD87l/tPBHF:L4AA6umCR1pqN/15XYOo3w7DRN+C
                                                                                                                                                                                                    MD5:55E711FB9A44D0F78BF7D2DE456DF09D
                                                                                                                                                                                                    SHA1:40FA8E0D24C212F887EADC1F5E3B367DDC5CDC59
                                                                                                                                                                                                    SHA-256:D9CC8E1F486ED1E0E0C4192D2F6965AA4B3757029A23EB2B340224DAEC2A48F3
                                                                                                                                                                                                    SHA-512:53B4593F8D1B2BFF3EDCA33DA8F809BBEFC6CFD634A91F766845C08A0B0B4D89297C0DB2DD54FCE5A936EDD42091559F891C0AF8FDD37595C499F52B05545176
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....pHYs...#...#.x.?v....IDATx..w.U.......Q.`C.$>..........4F.h ..]_.....b..n.-.h,)j.E.....D..**"6l......2..9..s...^.>...3.gf..Y...n.$......`...\...|...X.U[T.,..X....5...7..h....o..X.<...SHK.....;......l......'...;....<{...jul.lj.>.vn..T.K..V.F.3H.`6L...l..ei..z.[....f+S..W........J.h.f...`.f....W...j....g.............7...[....D...wz.YKk[dG..V@.1.N?...t.g;._..G.......=...>../.Q...,.'..'..E..o.....6<...?....hA.t.^D..hq.v..X.H.....l.+.5.=..Y..'...,>....8..ee....Em.he.!.y.......'.$8...`..'..t`G40...,.!`....H..C...K..X...!..Q..-.H`\T./.....V.-...PG...6F4w...P.9.....M.:g.~.......y..&.."U.d.5...<..%..-O.-.......x...`.S.S.;....`@.~.....&....H.Q{_..6.43..A....Y..hi.........a....."S..<....49.4W...9......f......e.lm....A.<.q....... N"A|.w..(.5.g.B........#.^.......h..;..qX.........q...2.Y.VV>......C....m.{y........w.f.O.....V.z!........?.yQ...........^V..h...?....ii.Y_|..,>...JA...$T....o(....e.....#z...8.m......a.y.Z..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\AAPzPDS[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2076
                                                                                                                                                                                                    Entropy (8bit):7.696513179351384
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:EJlEISLa+8DGwZH14OeeWwRxQLSE1n1KaAWQ8mG:EcISINy3axQLSE1ndAWQ8mG
                                                                                                                                                                                                    MD5:3A44B1F08690E2C5401560C95649E8E5
                                                                                                                                                                                                    SHA1:F65DCCDAD049542BC0667E916AACF24B3307A43B
                                                                                                                                                                                                    SHA-256:33423DA189E9A33E46550BEE4B8082E9364EA591A6504D1C528B713975757D94
                                                                                                                                                                                                    SHA-512:99C85D130C84F12F1F5BD82FD4633CCC505F883E364E8AE43B78DCEA357A90B529A548E17F43399E899B8BA42F1CC8926035A6FABAC162BD3B648B59DBCD3EAC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....IDATx..YHU].......).Z6O.E.@.`B.E3A=.EEAO%a.CQ.....XQ.H.E.M4".<.d.6.X.e.../.s...s.......v.>{.....'.>.q.R...E..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F........o.(66.bbb.._...);;........?7Fy.}.g....>|H./^..'S.v....9C#F....d~....t....2e..w..?an.1......y..M..4..QYYI.......s....<..........c......cG.1c..j.~..I.O...{Sjj*.;w..Y[[.......;..........;.7.r.x ==...s.~........')).)//w233.J|...Nqqq@.999.LAA._.....w.....;f8K...m...s..........C....p...\{..ggg;555Nii.....$&&:...<...,......p.....<.7l...bl...\VTT.e..r...<.....%...%.....O.E-\..>|.@eee4q.DZ.bEP}.z.}......nx...5k..`..z..7o.....5jd...X.].l-....`.UUU...Gz..9=~..N.8..h.s.O..`....9s..Rx*.......O.4o.... .l.Z.ha....I.&.N.......0a..u......s.^#...........BJ.~.z.*.`1.6....:--..!H(...M.6.fdd../m...X1f|.&../?-..8&X^^Nk.a.0.S^.xA555T]]MO.<.=..."w....6..b../..cm..eD.g6.....w..{......[{...

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\AAVs9cU[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1214
                                                                                                                                                                                                    Entropy (8bit):7.599946746969644
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:C/6yU0JRXs1C1zE9hrbmbvTiT9je3iMUEFCONRXTQUBwFaG7:C/6yU0XXu9xRje3FCOfDQCwFak
                                                                                                                                                                                                    MD5:840EDBF110A8FF1F0D9CA580AC5EEAC3
                                                                                                                                                                                                    SHA1:322B7EC2E8848CE0701323C95EBE68CBC911987F
                                                                                                                                                                                                    SHA-256:278AF8DB05B358D4A77C18906379F458402D3E0B4A905A51A5C8A05CA5A7FA6F
                                                                                                                                                                                                    SHA-512:A2E378275DFFAED9996262AB82F13EA701A9CA75E50EFEEF1DC09398D5E0B78C64ED12AE0BA7BB579E71AF70ED1D46F54E86F3B93189DC520A8B221539043DFD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a....SIDATx...n.9....H.:.p.N..2@.n4O0.Y...f.b.l.-...H..n!... .t.....7-../.oy6.|9e..cG.....!DE.DF.DF.DF.DF.DF.DF.DF.DF.DF.DF.DF.D...D.v....T0......q...ML.{r...@n0.c.P.}.../R...{^.S....?.aR._pt.1....5....ko\..G.F..y..Nw.W."e.!.Z....a57..,.&.}..{.....X.. eZ!.<....H.V..>.......N;2`g...w.:....o?6.ja.z..R.^.[|...F\u/C-.#u...?|....w.O.B...._.y....`.^.y.X.o...B.......[.10/.6..S......A-.~=..<%.^.....n._..H..]*.q.P.`...B- T..._.........:X..`.C..d...|.&...[..k+E'>......SQ.;m...0...p.0....4aF....f$5......P3.P=..P....j@..X......[..7ze.0A) .z.....uH....j@....s.....<.n..3..0.u..6...&.;..q.05.....N..{.....P.l....LA........@..`./.B...........q...d%.....>xo#.=.......7.=..........8...\..\.|..k.-..*...f..l......`...Sp.uy...`.G..}`.7.......J........1.:4..O.]0.9P.........#.C.C!.....{....;.+....#...a.M..e.."F......7..&.;.1C... ..M.Q(.........! p.......p.g.......9.I?..N.s@...]..I^..}.....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\AAyxkRJ[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18737
                                                                                                                                                                                                    Entropy (8bit):3.2844151735912424
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmgCxNXrNXNsc5MCrdL:bSDS0tKg9E05TKk6x5R
                                                                                                                                                                                                    MD5:0E24DBB269909FB843B94057283D62C3
                                                                                                                                                                                                    SHA1:1876120A624E3A7EF745C9EB0E05B5E47FBBE657
                                                                                                                                                                                                    SHA-256:0952BFC78774D1ABF4729092EFDF61B96FDA8BA06F47E0A95A7347A5A41BF0C1
                                                                                                                                                                                                    SHA-512:0E4F02B8C05BB2BA7E6924025A2222EE3583BA60DEF3FF48AF3A46669E5ED396CC5F7A90B9858B7CE0DB5C7E3FE7B50D6C9877F1F8DDE2DE7C2D8A6AE72B2205
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\BB1d0ujS[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit grayscale, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1113
                                                                                                                                                                                                    Entropy (8bit):7.727456978400816
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:6CdYQBAcBrSJs9tION6Gvx8nwpIZ/YCq46Ru3Nqm1NL4nz:6cYQBnPtLnx8wY6uJ54nz
                                                                                                                                                                                                    MD5:AF5A688C4ACBA6C2E57518F2A93A36EB
                                                                                                                                                                                                    SHA1:0FA67A1240915DBC819962263F2EFCC4380AB4B9
                                                                                                                                                                                                    SHA-256:F5B1B30384C129ED683EC4B26BDC18D8EA02B58155B816CC1B646ABACFF06E53
                                                                                                                                                                                                    SHA-512:4B17038A0CD1CC6491FBC9F13B090E64D0B99BF55CFF69CDD85BE73E9784CC55CCEF7EF39E1BCF6660AAC6763B98D1FD6F840462C0E85D857F9CF97DCDBB6204
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`.......(.... IDATh..IlMQ............J.....",.......Y.Z..HQ!] .....!R.`.j.M.t.hZ......g..n.p.;.yz....~....w.s..,.HC.+#...vt.y..?-(...{'.v.g.;`.2.6G....o.v........Ne.t...mr.:..1..P.s..N|z/..*a..&..'A.x(.l#.............*.|......3]......*..:&W..AG..L..&.Ep...1W........O.,@`.......9..vX.....t..{R.W9>....`.y..........C~."....=.7..#&`h..V.O...Z..Sv...SXs.D..].P...L..].w.4.:.......t(..T@.,...l%L......*...b.%8..Ze.T.U..X..,...\..9...a.\..{u..0....x.[gY......R.#...:.U`......."..yR..c..*H..q..0B...."O......*...q.L9....x....+..b...j.B;Cj.....I..@K.u....u.2.....a.@i..=.......N.....S...=...z..}v.....*@..P....S"...P.|........$..@;..1........&@C..*.......0r....p.3"u.+.!..Ur.....~.*+...YdW"C...-#"Z.....g...+.6)..3,.p.6.K6..5CA.qx!=[.-2...3..... T ..w.OY..t.`r.........m.....S^m...`....L..i.4.........l......G...F.%..I.5G....w...x.....o...v.....n.l./.(.........u.9V.....Q..Nu.@.i.......?.T..n.{.}..x..e..rGS.o..>RXL..f.3@.......u8....yGS.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\BBACBCB[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18737
                                                                                                                                                                                                    Entropy (8bit):3.2062466761310993
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmIKJHxNXrNXNsc5MVNzhpA:bSDS0tKg9E05TKk6L5gpA
                                                                                                                                                                                                    MD5:23961A289D57B15CE78E725C8DB95124
                                                                                                                                                                                                    SHA1:AD22B0DF2C88DCF74C75618042809EC228660100
                                                                                                                                                                                                    SHA-256:0B428DC30D2F11B851BB4790799644079FD5102F760496BCEE1DDD5447B3233E
                                                                                                                                                                                                    SHA-512:D90984851193DA69AEF3FFA6F5F2710D230533205A190619A47F006EE9D6CE92085B0E04C23BED04269057B3620B3CA732679A1EE4F1134B6C60C7498672CC53
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\D895PPYS.htm

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (58855), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):190493
                                                                                                                                                                                                    Entropy (8bit):5.461125706770369
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2y1CzNFD4LWDoRLk/h5NyhwNuORAK/xYU:2sC34L3RLk/NyhEuN4xYU
                                                                                                                                                                                                    MD5:51ED6357450ECD68A563D0B39E8141A8
                                                                                                                                                                                                    SHA1:20FBD8C6C52B00E1B27F60C216CFEFBDA8626DA2
                                                                                                                                                                                                    SHA-256:85B4467B16087181FCFFE02AB2DC46E193DBE2832726138811DC6F2C3FAD9362
                                                                                                                                                                                                    SHA-512:2559534F9EF6A305B21DCA807889E100F724D8DCA698F2D63FC8375B9AD8C5CC9AD46A23DC631EAC7DD03118C08736A9FF00D26A2269BC492392567949733D2C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,prg-visser,shp-xap-gr-noux,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,prg-1sw-sa-uiehacv2-ctally,prg-1sw-sa-qryan4t7,prg-1sw-p1size-i-c,prg-1sw-p1w-c,prg-cg-rr,1s-eaop1,prg-sh-badgewc,prg-fin-hl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-pbknc,prg-1sw-sap13nbrnc,prg-cg-uxprod,btie-brandsft-c,btie-aimclickbait-c,prg-mscl-hld,prg-msclck-rf,1s-fcrypt,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvc,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-iprc,prg-ctr-pnpc,prg-upsaip-w1-t,prg-upsaip-r-t,1s-rpssecautht,jj_fac_t,prg-pr2-cbdgendpt,prg-ad-article-h,prg-1cashback-astrov5-t,prg-1sw-shipfin,prg-1sw-enableact,prg-1sw-fnccombo,prg-2cashback-astrov5-t,1s-wpo-batchuup-tt,1s-wpo-batchuup,1s-wpo-pr2-ptasks,prg-ad-rpwns,1s-defaultscn,prg-1sw-pde0,1s-defaultscnw,prg-1sw-tbrcounter,1s-notifmapping,prg-sh-frnrc,prg-1sw-spnot2,p

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\Icon[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):533
                                                                                                                                                                                                    Entropy (8bit):7.415663553371965
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:6v/7Ya7/6Ts/o7hJW8/t8oX8qUkUGGVIXC/zoZ3VYZwWSVR:E/6pzWK+q/UGGMC/zw3oGVR
                                                                                                                                                                                                    MD5:B6162D100379E7F4EF709BA5C26D1BA8
                                                                                                                                                                                                    SHA1:AEA4244C56F00AA26064134863157A6EE9D7ABB9
                                                                                                                                                                                                    SHA-256:DCA74022BEBB4F12F8EFADD226C9413CAFFF9193420D604DE8A398642172AACA
                                                                                                                                                                                                    SHA-512:CC64207C45F85255F34A157C9370A46EBD4A2B3A674E639838EF7582FD93D68F91A275C577E2FC9A46674EC765D8CC43A5BE28B281FCD5006D38D0C6F02E2058
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...<... .....N.......pHYs.................sRGB.........gAMA......a.....IDATx..=O.1....$....1..7.....p32..)..Yw..p..IL.$qT'......1.#.h..j.5...9...~...w.....oe.....]8,..|..........``.$a.K.&Lq........D,D..8e.c.....fQ...u..%.(..b..8A......,>@6....Y*...9.(...d7........,!zr.N...T}.....j...NY'..|.=N2Q&<?3....@..-.e.h....F#..2.v...n..!-.e..&........%.e........y.c.y,.e........4'40.t"...B.........D.../[D..6j....^>.....g...3...5<Hv.H../M.+Y`.......OXw<a.al..aF.@.../.E....=;S.K....s.......IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\desktop-shape[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 7 x 13, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):197
                                                                                                                                                                                                    Entropy (8bit):5.986656121330302
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:yionv//thPlyyta2/uDlhlp8Lts7CX9/2yx24lSXqU3hjg/BFCb0cCHxlbVdMaW9:6v/lhP1b/6TsR/R0Zjgz89CXVdMndp
                                                                                                                                                                                                    MD5:34760615AB0C180EB4B48739297FD0F2
                                                                                                                                                                                                    SHA1:789438D09CC27A08879B1A9686C82527270E7C24
                                                                                                                                                                                                    SHA-256:360C33D59E7358579601909D4CE91F1BCABF9E07BEB8F69D50C226D7D8F91260
                                                                                                                                                                                                    SHA-512:1CE7E574D45D123C6B52119907E74D71B842F1CC380D79AEF876FDBC9FDB663F385BB4191650813D2E66EFE24265FD36EC944AF95F372C0413EDCF11361CA666
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR.............e.t.....pHYs.................sRGB.........gAMA......a....ZIDATx......@.EA.`...U..1\.......X]...G..{..HU.4Uj.`..O .3;..\..!3...q....[s./.@@..p...>.`(k..2.....IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\logo[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 1633 x 708, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):27928
                                                                                                                                                                                                    Entropy (8bit):7.701164569435742
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:xSufGKAfaoovahBv4apFM4lvzDpqFosGd+Up9FIK0B:jfUMve54E//fCiIK0B
                                                                                                                                                                                                    MD5:862D29153222B9B15C3C73B61B930335
                                                                                                                                                                                                    SHA1:391BEBF4BA8910B718C5516491EB1C7D32D4C187
                                                                                                                                                                                                    SHA-256:3EC8FA41DCE2684102F4A7B2D993388809CC2F6AE0616807CA9E3D94E6D19AC2
                                                                                                                                                                                                    SHA-512:6FFCB08DE27DFA571C8EF35E7F017F2871482581308C10CF38EFF9A507D02325222B899D667FC86227C2985ACA05F17C1CD33EF4163BE3442F70F8907BD78404
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...a.................pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<..l.IDATx....u.7.0.A......@...T`o.f*.SA...T`...+0UA..BU.X....a,.......u..:.%..`... ..........a. ......................N.....o..z..=.....r!..^..Rr.....J..b.{..x...9^....u.^.?+.......!..kQ`.....$YNo\/..km.4.n...........1H.0\e.$]^w..K.^....r{I......0.I.v.@!...6.r\..JI..n..9W......<.$.O.0.3]...W.|..n.B&%c.)......cI...e.K.^4....ZX!......C$a..rl.x....|%..I...x.]........I..m..a.?.vml76.O.:.lW........0|..!.M..D4.%..Yt..1+......h.$........w..c.B......&I..._.e..R.%c......#..b.K...d.....@c$aZ*....&..R4.F2........0-.r..n.|y#..H.Y..VB.....P....n!......MZ..W,.E.........>V..Z.!..E.ND#{..:...\(......!.Sc..0....Dq....eK......(.$LM.i.K->t.d.g......(.3a*.~.......x.b........\V.^..C...A.....Y......@Y..)X.a.?V..L.R.^.~+......e..)T....x....2.=..y..............L./..!..:^..}.........Y.S...i.Xv.0-K.b>.p&......y.......r..~./>u.U1+........0..!.:..x]...Z(......#.....<~.....s..........

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\me[1].json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):85868
                                                                                                                                                                                                    Entropy (8bit):5.340877761578525
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:e0l/c5QdPxMNtohOLlNEk8tYWEdOOHlooT0hFs6GEK3mg0Y3FA2t5PuEojTo1Aho:esQEBO/xeAj
                                                                                                                                                                                                    MD5:611C64D883FB2C60372038F9C0E75845
                                                                                                                                                                                                    SHA1:8F3C3EB45D6F355E30F426885CB413840280CC16
                                                                                                                                                                                                    SHA-256:3F2A9B5762785B352E87CDE7DB2BB7641BBCDA59F7CA8324B4E5808B71DE5F8F
                                                                                                                                                                                                    SHA-512:5A5F8B75F3C2D180A648152DCB393F1DDA8C1AB04825FC5205BF426E3DB2B679B46DB2F846D7B8E41517DFADA251DAA9B221D0DF17D4FB616C66BD8C8F0A4047
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=037f6c7e-4d24-453c-84b3-0a57b795bf15&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1jRdhE","type":"article","title":"Vice President Kamala Harris to make historic visit to abortion clinic in Minnesota","abstract":"Vice President Kamala Harris' visit to a Minnesota abortion clinic comes as Democrats wage a battle against reproductive care restrictions across the nation.","readTimeMin":2,"url":"https://www.usatoday.com/story/news/politics/2024/03/13/kamala-harris-to-visit-planned-parenthood-clinic-in-minnesota/72966176007/","locale":"en-us","financeMetadata":{"stocks

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[10].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13018
                                                                                                                                                                                                    Entropy (8bit):7.950738187171057
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SuA2XX2tj2AWmB47dlAbArzC/En2z2WWec/Spzv:Sl2UjjT4OAV3WWe6Av
                                                                                                                                                                                                    MD5:4EBD6F5ABC980DBF2F2B4C78EC5EF5E7
                                                                                                                                                                                                    SHA1:888DC9C50E0B139A33A4DAB7CCAC137A1B42B556
                                                                                                                                                                                                    SHA-256:0D7A10870E3BBA1D5F8B0ED04DC087DD68C9C9C02791C2560693E93EC84B8C2A
                                                                                                                                                                                                    SHA-512:9D999DE3B7AF001BFF12F787F3426BA915B8CE51907E54333FA99DCA33ABEBEEADE6DD0F10285C9B5FC1B95EA5EBDD26CD2D98B64A076EB4A8FA61F5AEFC741F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..._..ME.C.+2k.....oj..6....I. .5....C....j.c'u+.V.r:..]w.~.x..:h.,a..s.o....cE..k.....\..t...d.3.]XZ.;=.p.Ye.6.T....xO.).....Sn...U.....<#`;....N.MAq...S....v<......E.....T.D.[.WN..>Y5.....5.......(...yO.QI........z..n....Giii$.Jp..$.Qk...2.9_..+.."..D..3.?...^_.zW~....)..o.... ..K......4....<A.....^jZcE......t.pk..j.1|7....oV|.m#....|Di.f|.,..g.?.#Z...

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8481
                                                                                                                                                                                                    Entropy (8bit):7.94164240604086
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Sa4HaeGEfQ/pOoph7REf5i7XQWknhlQQifN/mQ40WGmC56/DZ:Sa4HblfQcojaf5qXQW2h1Q4qL8/F
                                                                                                                                                                                                    MD5:9C4968E2E958DC552F6B1E73D4CBE2F2
                                                                                                                                                                                                    SHA1:C209332B2FCECA8B6234B81D1967512BF72F4456
                                                                                                                                                                                                    SHA-256:E5BB8DE9B1093B492658B553D2A9E2CEB37D9F797233E5C8804560767109DD95
                                                                                                                                                                                                    SHA-512:60F4F8CDFF933E1053FB40AC424EDD92B01BFA5289F8610DD44686C09C77AB90318DE6CD9845D9432156032F78DAFEA8105C50B071BD0835844E396B93919D0D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...f*..."...u;.z.s.l....Z...../.3.[L...3..r....jr.......F.sR..z....=..J.T.r..P.......)c...4....~Z..}(.1.D..i.$k..".R,|..S....'. J.8.....W+..F:.......d......88'.JME]....nh....N.Vk.(..p..@m...zf.._.|A.\3...k.*....$VU..H.d..&W.....e..~..C..^.=.O.h.M.V.,zm}.......n...`.....Z..k...'....Z..g.F..".X.uE..M..8...x....Z.&.s/..#+ ..{.xK..f.D-".6.....x.s..0.).

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[2].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18367
                                                                                                                                                                                                    Entropy (8bit):7.965313915953571
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SOgtotXDL7s94FbVPe7skkZWvDryPecEIGL9DHcL3N:SvtiTL7s8bRe4kkwuPZEI49Dkd
                                                                                                                                                                                                    MD5:ECF8562AEB5421270F92AA4023C73C74
                                                                                                                                                                                                    SHA1:03C806EA3CA4FA0E8B1FACEBC2D9EC372AD15FA7
                                                                                                                                                                                                    SHA-256:1508376C3A7E6CCC7A9DD8B5E215F766D5E1B89785D739A3F69209FE38ECE606
                                                                                                                                                                                                    SHA-512:A9114534EDAD88AD14279A7B42DE4259EA5AE3646DA3B1ED764267C5127B74F28025F1A7DD4F7F6074F45B08B3B0B796E9DEA33CAA53047A28D4DEA3E11A5580
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....)7.J.e.n.c.c.5*.....7..W..s....]..I......K........8.o...G{...W..(..3.}J.x.M..._..R..Go..E*..J..+...~B....U...E;.....4y../.n.......d.....c...7.."<[ ...Q..<^......M.P..:.s..y.Gn.D.d..I;....;.../.Ny.L{1.[....j.....5....Mx.n...JlQ.....s..rqW.f.H..7.6.....v.j...V2.H.!#0.a.{$.;c.+.YB..a..}.~....=J_..s.k..X.....7...py....m.....Z....2..?7M.4.tiR.j.sn.Q....".,..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[3].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20367
                                                                                                                                                                                                    Entropy (8bit):7.959171958443
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SSnn3yQPu+2I3f+nSbhEyS/Oo+Xr6gBsQKE4j176u7Y5LXyOMOasqRDi:SS3yQPjpf5bh4Wf4Qj4j17Jc5GO1as2+
                                                                                                                                                                                                    MD5:6F31B49DD86651C7B3C600A7C96D0DD8
                                                                                                                                                                                                    SHA1:32992C34B1567E45ED8A1E69A9CCCC3369B011CB
                                                                                                                                                                                                    SHA-256:FB4260D91E4D6F4F428E55C783564A292C2444D66927B9F43792480514D79348
                                                                                                                                                                                                    SHA-512:7A45010533644E6092BEBBCBBEF5772168C66FCB61A8D134593C780A925FA80EECEA9A3915A9EB99FE6FE0F627C2350653FD9FF9CA43D3A7E9D21D66A0074920
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...q.Q....GZ.3..M@.n..~.y..=..."..}*.1..$.a.MC3..I...H...9\}......[..<.sK...X...Q...A#.b.....(....6. .]J..y.....,q.V..".F..9..i.M..[...8...Q..j..T..k....E..Q..A...V4x.1..9....+....Q.,.,..9..*.Gl..b...K!.s..=..j.EE.;..9+.bQ"+...V.'h.tT68..5.k...y.(....5.c..se.......l.......g.PE&0....Go..Uh....6[.k.QZ".'...`|.$.(.s..lY|.[.z.k..*..n.f+............8.Q....d.&(

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[4].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):19275
                                                                                                                                                                                                    Entropy (8bit):7.964569281213879
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SF/tH8Y15tFyCJU9Jncn9vTY+QQoZbmHFOYeGKcqZYzT:SFVH8S73knc9c+doZbuF/qq
                                                                                                                                                                                                    MD5:1A2BB5A8E741EA94F4F9BFBB79188962
                                                                                                                                                                                                    SHA1:30007167226737FADF2A1BDFCDFB43ABD85A894C
                                                                                                                                                                                                    SHA-256:6A50CAE58F69DC963FFAF54CE36A106CC4EF863A36F66328B91037234FE5BE78
                                                                                                                                                                                                    SHA-512:2BF4FC2C475F51883799DF361CBA765FE81DF8C5C8C112B70308CEDEF985E8C61F9D8FEF4980FE602AF6ED9C09E5D2EDBBA0A92B2F61AB493FB6CFA8EAFED9CF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....C%.j.S].....J.;y..y.dX.hK.7.k...k.IN....b0.i..Y....Y..b...!.._Z..Ui%....V.+.9o..qb.3.Q....4.I<..)..w.M...Fh.....+....\.....i.o...d........ ....6....h.+..4).+<.,FF;Rb;m:o.......f...m..`..u...I>....E.c..n..:.X...G....tA<7.3.U-.x.r..l...fd...4.../J(...-6.@.X[Oyy...o..A.K...W.V....o......=^.G.......&..p);D...>...I9...f....%.D.+j....#.?.....i./\.V.y{{.$zf

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[5].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):23901
                                                                                                                                                                                                    Entropy (8bit):7.96556860722461
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SeP6BLYz6IP5L56mZ63HYW6KEk7pRV4g3kK9cPMvz9QOTaX7996JHg3J1:S869I7tfyag3FcPMvJnabEHe
                                                                                                                                                                                                    MD5:DAE74229C37341CC56FCAB61E6A8740F
                                                                                                                                                                                                    SHA1:4BE2AD550F3E9D0A600AA593CD0365F6318D4A03
                                                                                                                                                                                                    SHA-256:1C24BE0F0481870321813718C1AB7D8F31FEDDDACF7AFC6516C278EA3B7B298F
                                                                                                                                                                                                    SHA-512:0DA290687D83E44949EB18109CDC0A06628A2DC051611C68B9B824A4DFA9335881CFABA5A87A854E28AFC695BF2D43686B45F0855E87A4BAB2F69196193FB3BA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....Q.....s..~...u...W.~j+.e..k.u....8.FT.7@i..t,.C#.c.##'..O.I.....f5gH....=.Z....Nd*..#.0S.T.;.q...,.E...3$-..P.`...j%.(k.6..C.V.28.P3..3Xnt.l.q....(..0..L...b.._. .....Ok..A4aU...!9;.9$..=qV.....F.8..~..J.<..3:.a..s.gVr.+6.......e0..U.QX...V..(.H...G...?SZ.l...M......dv.=.c.5./.....(.a...^Xwpz.9.GFM..#..z.r.i.Y...is.m.Z...Kx..z..p..>z.K......<......q..t..w^.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[6].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):53215
                                                                                                                                                                                                    Entropy (8bit):7.968254604841664
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:RL4Gp0hgGG26ZIXksOiLNmyw/MHh5NVFX4cY3+/XJMDF:h4NhxG2VSipmy0u/njMx
                                                                                                                                                                                                    MD5:5B21B76B67D81E355B6B04DA6EF9E708
                                                                                                                                                                                                    SHA1:772DB4A61ADA366E1D67CF81F52AB4748093B731
                                                                                                                                                                                                    SHA-256:F62EEAF9021B8DAEE3BA67272C40D8E444D6463A0FFE68F9CDCE3C5A366F596C
                                                                                                                                                                                                    SHA-512:B25D3E1C58605BA5CAF4435AAF689A00FC754B02C8C670F3624C413D85040ADF6B476E8BB253D382A21A2088FF605AF4FDF91D441CBBA13F3389F05215B2BA11
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........4j+c....g.VL.......w.`s]...6. ....f..8.Hb...n.J.......s.~....|]...Z.=..m.f....y......~..>...6R.y:....dWs3...2Nz.k..15/.i..tk?.X.X.X\Ka....8$.......:.W...|O.t...r.z=..x..f.......3.g....C..Z..\^Y..+..o..$..g.8..~..?.>+[^.}.N......+.;I..Mt.]...d.V.....E.P...Ki%..b..zW.~.6Z'.~4:i.&.O..:...x.Q...a...z...h...^(.e.-...i....`'.....S...n....sj.....c..3.J.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[7].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):14345
                                                                                                                                                                                                    Entropy (8bit):7.949856881897032
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SS7Tm+qrdJLzY6WPcCXffe0BE9HzPU8nL3MedI2ilf5VxD2xFheIkem0BNuuU:SS7QJLzYVECvfe0uPHL8RTlMFh5HVBNI
                                                                                                                                                                                                    MD5:ED0F82442190E5F384D3979467926FCB
                                                                                                                                                                                                    SHA1:800E1ED5ABADFC64032675509F78586CD104BF74
                                                                                                                                                                                                    SHA-256:C30277F100238C7B1C30D1C491AC50DCE4DF577A9E2ABA1BAE2B6576AAD68361
                                                                                                                                                                                                    SHA-512:57D95B62917A287647ECDCAF2EA8C41A09060C643C21E1949DFD1BB2687FCA337EF30A184241D601C628569084CD53CE407236B2E5E0BC3CD7BD007B5B5114C8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(...(...(...(...(...(.......^$j.<.8.w..[....K.i&.#.......Ez...>.7>\.....#-...A.{7O.T.......,.V.....#d..`t.A...5.xk...Y.....rO.{...:(..Q.\...<.....T....j..q....U....KL.6..=.8.K-.....?..W.x.[.Wx..pJ........n/&..V<..*...W.....)e7...V...I........K....z..H..k...G.{........M..p..z....>6.m$.....K.\/.B.......|-...o....pS.A.==k....M..e.WI.....,.x.#.......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[8].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9069
                                                                                                                                                                                                    Entropy (8bit):7.938507182083754
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SDbd0XrXDjtZcFyX2giQFgbzKUxhE6SmX83lofskeSCbFlwlQ0:S9eftOeUMgbLxhnSmX83+fskgbF2Q0
                                                                                                                                                                                                    MD5:F5A92FC24B9CB3E1F7BCEA80E7C87F64
                                                                                                                                                                                                    SHA1:A093B2375459A11247EC4A06380B46F56BB00DB7
                                                                                                                                                                                                    SHA-256:BBD80F8FE5B27B85831AA6B9423DF44157181D4E8A55BE1BB5C77A677FF88EEA
                                                                                                                                                                                                    SHA-512:E512008542D06DFA59F432716FE77E28F85F8309DAF9C2D8FE00C949F69A761CEEC15B6E83122E2E6A84B4CFE6A55AAFBD6CE580023354B1DC67B30EC61D2FA0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...z..#>p....^.......=#...~/.....S........~.......>..8...i.'.h..c.5..*].....j..~...}O:.b|.^Q...}k.<X.k.5..,O.Z.u.c..?..lc..R.R[..A.W.....[sV.1.qZ...F.HQW|......6'c.'..,...!..6f....T.f.d7..M.>..P...EU......3.Q3[..&..j..Gz..o....r:.b)Z".+.....|....CY.B.3..[..2.}..S..).H..Z.tw.t.x'.K..+......2$.l..<.}..Z..]Z.y..j(Rl."..n]s.).}...{Y..U*0.......[Z..<...k.H.....Y

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\78TQ6Q6A\th[9].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12317
                                                                                                                                                                                                    Entropy (8bit):7.9551926811866345
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SGvYWr60Iq/gk/PysBE3ffiBefvw2olevQ4t1diCL5E58LBtKVlWU92:SGvYLkH3QPfvwtudS8tIlS
                                                                                                                                                                                                    MD5:3F53615E5557D1181401244B49B3D8E3
                                                                                                                                                                                                    SHA1:44DC4D36C6E6F203B0F1F8889729D3856DDC48AA
                                                                                                                                                                                                    SHA-256:32B0717CC0706188952F2A2D32F3C4702CC78DE686F5DCB1277805C5A54C72A3
                                                                                                                                                                                                    SHA-512:3F69404D868EFF1C24C65CAC8B2D097D607C6C7E70D20ECB2195D92E0BC29711DE2F4D4D45F9FAD515DEE7DCB8F802566B3526C255FE51C64D7F43A16639243E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....g.iY.*.`..V...y.>..n..J..mZk.@>\.U-.}...m..O.pqq7....=..M8.H1..:w.nx/..G9.........Kk..`.U..<.\U.%... .S.Y....u.....bG,dq.5..F:.D(.....J.]0.9w.BH@o...u.....}...<&.s....B..N..s.xo...Ac.g..5..QQ.T..G!...m.$0..t0.....%.&%8?.{.........1..>.....b.".W$.z..<.M].2..Kt......~.\..X...4~..._......d...~....4yM....G..y[..>f.sW:..w.i4.v..._P.i61.....y...A...wg..u.+...17

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\7V0SRAX8.htm

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (58855), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):190493
                                                                                                                                                                                                    Entropy (8bit):5.461119517264395
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2yeCzNFD4LWDoRLk/h5NyhwNuORAK/xYU:2/C34L3RLk/NyhEuN4xYU
                                                                                                                                                                                                    MD5:834A813877D8E21BE6BE5C67193B4715
                                                                                                                                                                                                    SHA1:F404C78705F93EA261BBF645A741FD7094A1C324
                                                                                                                                                                                                    SHA-256:FDF82D928B8087FAD0CC37BDBA87537D257748E3C900B7AF492134E7FFAA103D
                                                                                                                                                                                                    SHA-512:86740A42090AD78FD6DB13BB306927EC2F4D1E019972D77429FE26CC701B2A0916A8778482438ADE89EC75E6D9615951547C7D413CD2826CE795E633EBB00BFD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,prg-visser,shp-xap-gr-noux,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,prg-1sw-sa-uiehacv2-ctally,prg-1sw-sa-qryan4t7,prg-1sw-p1size-i-c,prg-1sw-p1w-c,prg-cg-rr,1s-eaop1,prg-sh-badgewc,prg-fin-hl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-pbknc,prg-1sw-sap13nbrnc,prg-cg-uxprod,btie-brandsft-c,btie-aimclickbait-c,prg-mscl-hld,prg-msclck-rf,1s-fcrypt,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvc,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-iprc,prg-ctr-pnpc,prg-upsaip-w1-t,prg-upsaip-r-t,1s-rpssecautht,jj_fac_t,prg-pr2-cbdgendpt,prg-ad-article-h,prg-1cashback-astrov5-t,prg-1sw-shipfin,prg-1sw-enableact,prg-1sw-fnccombo,prg-2cashback-astrov5-t,1s-wpo-batchuup-tt,1s-wpo-batchuup,1s-wpo-pr2-ptasks,prg-ad-rpwns,1s-defaultscn,prg-1sw-pde0,1s-defaultscnw,prg-1sw-tbrcounter,1s-notifmapping,prg-sh-frnrc,prg-1sw-spnot2,p

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\AA15spNo[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6051
                                                                                                                                                                                                    Entropy (8bit):7.953312701061704
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:CSfA5nUUj9bBvGgaYMYmrVmxF1KOdZSGpWT+X5Y0hGmJy7bDMU:CSlkNvwYKmxFLrTpWyJBrs
                                                                                                                                                                                                    MD5:79A49BABA1C4B5B5E0C6254090414753
                                                                                                                                                                                                    SHA1:92404B361801B9273F8C90EA756EE2DCE09BBBF8
                                                                                                                                                                                                    SHA-256:A9B46ED8F8F6C657DC2C80522EA68EB4FDDA317E79633DE3603762857C426CBC
                                                                                                                                                                                                    SHA-512:35FDB0D4D2654FA7A649D6384F8571727EC6221D40049A44585F470AD0330E651B5969208CBED5158BF042D377FDE7F336C3052528CD3A7205693E7BDC84C3EA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....pHYs................UIDATx..]{TSW..%...B....k@.J.."...Q[....8:.V...-...fM.N;.....U....v:...R...>G....<T.(..3$!..........g>.k......o.9...w.DDx..Ah.....S.X.O.`a<U...T......0.Z[[Q\\...........eee...EKK.T*.....5.............b.1.........a........-((@ff&.9...<...<.?.\....#"".s..ADD.O-..O...9.c....(,,4.3...1}.t,\......aeee....0....._..#G...BNNN4..|:u..O.S@ww7m..<==....$gggZ.f.UWW[J..Q@~~>.5..b...OB..F..M.|.%D.x...j)--....-......v..I*..q...)@....;...~0........%....JE.m#.......Z.b.544<.._........P(..`M.e.QGG...c~.....';;;..t(.~.zR..f..Y.p..iruu.. .J"..v..Ez..l22.....)((..B|T..dt...s..<......x.../......Fs..<.HMM%+++...O.i.Y.".....I..........D%%%|..x?.9|.0n..7[......m./........EQQ./..r9|}}...!..@D(++C[[./.M....2331y.d....s.g..c..K.....J%566.R....(..E./.Sd..$....N..%.......J.....Pp..E466....~...EEE.s.._...Z..........3LE}}=222x......[455.U...v.o.^.g>..bH..!..b..vvvF.....U...A.....0a..-[..'C....PWW...,...Dii.C...jaee..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\AA1dLSHF[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2013
                                                                                                                                                                                                    Entropy (8bit):7.81099098044133
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:qcPmqB8c1a5ShKNuK/z3amAq5zGQy7EFUQ9:J178ohKNuK/zLwQ9WQ9
                                                                                                                                                                                                    MD5:1F3C2A6537F6260FE81A7CBFF4BC431C
                                                                                                                                                                                                    SHA1:E779F157168D274F1FAB870C85349C9A9F9466CA
                                                                                                                                                                                                    SHA-256:31D6A3E91B525A985991C7B179331B814C77B54193D22E594B09018FD7AA5637
                                                                                                                                                                                                    SHA-512:A3004D5701D6E88D35B5F946A26D0C893D681E9F8651C7E0F0996CA85048685C37197BE975C8E9AF3825F77A5582ECEB246687851EA221837770A8DF257DE599
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....sRGB.........gAMA......a.....pHYs...#...#.x.?v...rIDATx^..K._.........n...h..._.T...c...>h.J.OD....c.]....[..4."".B....`..^..~'.>3{.......,.k..3...g....,....CX..c.0...0V..X..c.0...0V..X..c.0...0V..X..c.0...0V..d..vy..)....-j.\..V.^M^x.].._.|!/<...0u.T.={6,Z..f...D.>..........l.......b..i.QM..l..9z.....E.-.Y....Q...,//....^.-.F..............h.@..g....V...SO..+.<.>}.s...'.L....]....3.ah...l.....=.:w....q..}...'/..}.6TUU..OiK0Z..........fNQ.0..oa.....+....D..f..eT...L..T...t~..AG...3 j...0.....r.G..A[[.y>......X:..Xgg'..'.3............m.pww..*.c....E-.eee...3..Y.l.444../.}sg!..;w..'...#G.@ss3y.\.4...6..X...3.0u.b``.9v.;.e}....z..E.....aH...O.<q..'....l....r..i...K.....\,.p....I[....Z...(...w/v..u.`.}.!f...,..E,.....L\.....PK.._S+...p.O~~>.....%KhK0q.CHEE.........,...aj9g.....c.***...~)l$...g...O..q.CX#p.7n...$.'..<..]..D:.U.[.z..9..6m...$...`..p.B....7.T.[..|.2..X.`....-@..... Na..wp..I....!.$`5....ni..FW

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\AA1lLvot[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3532
                                                                                                                                                                                                    Entropy (8bit):7.898834558255451
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:C/6rD86PqmSUC2jKD/YDIkYCsPC7eKckLHvis8aVyt51nl648svBInwA9NunIbQx:CSrXzC7jY7l+U/ckLPiaG79vQMXYRLu
                                                                                                                                                                                                    MD5:47D01EE8DA7EF964B63B713A8562EB5F
                                                                                                                                                                                                    SHA1:742B956BD1BFEC102353CBE7050A99B8046A1A50
                                                                                                                                                                                                    SHA-256:FCCB19F39DD8A2AB0B87B212A020B5B61CCC954505DC8DF3799D9779382F0E4F
                                                                                                                                                                                                    SHA-512:BDBB9A109E4E39B885A40F91A5E2183443036B4B84B014F6A857645FA622DCA3A59C3B5B4BE100174E609216E795D5E01E4F04FD83BE490648571AF8358589F0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a....aIDATx..\.p.....>..."$@.+.....@|.8M.....2...@..../D.2.QQpFh.%..Z.I.[..tL.P..(..I..bB...l..M......._f...=......s.F.|m.lH..lH.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.M.d..H.........8i^.A3C........}. ..-.....6z!..\M.2&Q.+.|..j.:C..*....:}M4\...%I..)..&2..B=#.8.G....s.'..7..1...=O..x...?..aA....;UW[XDQ.`.2S...Y[......l..$.....'Ew[......^..n....M)N.....X.w.u;Z..,fQ.o.S...v...S.,$.O@.If.(...#3...dC:.3B._`B.uF._`T.$...ihV....h..d2BF.....!.H'...D.$.;....k_.t..Y..: .:.A= ..*g.&............rK.m5$.CF..1]...a...o.;.`S...5._;T.K.....:v.K-...lN5U.:..4...K...+.....4.......e.i.U..`l.s.Pm......Z.?....X.5Ac.@...57......U....K.[.p.`.._.....).....'+ai...W.tZS..m....6^.u.X.3...@T;...ic........._..|...)|....s.......R..ZXG.wHW.M3..h|../u....^................Ku].....Q..eO..P.....v0K...q.....I6...../....|...e......i>..v...v..v...BL.A..X."H[.K.. .=^2.;z....9...d,..G.5.....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\AA36Tom[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):331
                                                                                                                                                                                                    Entropy (8bit):6.836736228609407
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:6v/lhPmNpkB/6TogjnDsp9aXaZ4eJcAVKOt2sgLNHvEE/BsaOxycp:6v/7uNpkB/6Tog8sevNt2sg5HMSBe9
                                                                                                                                                                                                    MD5:217F503D30923BA5958A41D356EFB324
                                                                                                                                                                                                    SHA1:BEE9CEB356810DAE6729FD3194E98CF84FF13770
                                                                                                                                                                                                    SHA-256:78AEBC311A219FCFE478659A02EB863E15671651B77D283FFB71E9197C2E999A
                                                                                                                                                                                                    SHA-512:14ED9DD8325F7FE88B7FEACA1BA2AF6DA4824A01B65D6801EE6A2C0B4A009E21E44ECB1A2CC2F291CAE887DB20EE0CA76D182B8CEDFC02975668C1CD483A31ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...............h6....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..R...0..e....j.......I... ../:.y<.n5x....e..[.+N.9.>...(....:.?h.p..r..{...<.Z..u.......,@.u.K.y.A.......}....iPW_...q..u]c....<x.B.E.........(.[E....t..-!..0g.. ..,{p~a....p..m......a..a..B..,....?~.....d.n9.A.h....IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\AAPHGTS[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5455
                                                                                                                                                                                                    Entropy (8bit):7.529707846296668
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:CSyknmWIBRz46/Nj44NGhYY53N09G/Gq22HIsK87qLOejUtXOqqk9te6wS1dswsp:CSyknoz4Wj44a22or8Vtqeen7wz+m3M
                                                                                                                                                                                                    MD5:6DDDB106136E4C6C5B5A36522E739548
                                                                                                                                                                                                    SHA1:F93DD3D6CC5EA8D0BB76CC63CDC1181773ADA9BB
                                                                                                                                                                                                    SHA-256:1321129C9F594C71F606C8424CE39C89BBE89BE34F3107CABCF43DEC5C7A7C60
                                                                                                                                                                                                    SHA-512:48462BFEDBF3A1F2FC1F3F28ADB22599D4EA1A1087BCF0267F30D86258EC7353CD93111F8D6A6B1473AFC988EC56C23B90E92BB10FF081BC777E1E2F37A061E6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....pHYs................#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.7a7a236, 2021/08/12-00:25:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmp:CreateDate="2021-09-19T00:03:58+01:00" xmp:ModifyDate="2021-09-28T16:25:22+01:00" xmp:MetadataDate="2021-09-28T16:25:22+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:31b1080a-c932-7344-916f-f533e2dbf988" xmpMM:DocumentID="xmp.did:31b1080a-c932-7344-916f-f533e2dbf988" xmpMM:Origina

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\AAXL7Uv[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5765
                                                                                                                                                                                                    Entropy (8bit):7.923984876084066
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:CSDZ/I09Da01l+gmkyTt6Hk8nTN0MuAoKSA92eVU7NMQTbvJylB:CSDS0tKg9E05TxuFA92JNMQ/JylB
                                                                                                                                                                                                    MD5:C64469BE90122B439E5E71EB4355D97F
                                                                                                                                                                                                    SHA1:51B8FE00B807ABBEC07B1D9DC5C89370C4EAFC5F
                                                                                                                                                                                                    SHA-256:339B7DFF4B089F3A1257EFF22E4C4042B5B7BD0CC57DA1D224DDDAFDE4475835
                                                                                                                                                                                                    SHA-512:26D0580B853190CAC374F93BB4069FC25CF8CFF412284120AEA23FC993F5BDD014EC270906005BD492F992F9508770AC5102D1AD789C10B018A7FDFDAFC74417
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...`...`......w8....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\BBUvpML[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4], baseline, precision 8, 16x16, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):941
                                                                                                                                                                                                    Entropy (8bit):6.976699709097011
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:QqJSk/ehpK2o0XxDuLHeOWXG4OZ7DAJuLHenX3LZMeYQE/grQ:38k/zuERANuZQEYrQ
                                                                                                                                                                                                    MD5:4C107602B0444C92F80651676F732E94
                                                                                                                                                                                                    SHA1:C2F042E84982627F9E2BC9F32D6A7561138D86D6
                                                                                                                                                                                                    SHA-256:8F3ACC4F0FEF4D88F5A7BD0728D4697E56FAFEDC692764A55FC78865850673F2
                                                                                                                                                                                                    SHA-512:2F6DEA4C98E4A63A2FE9764C75C208D49C2039F81368B72671AD5A0B3F17F87CEDC8C45D47C0241E3506AB19F7CF1BFE2F7DBB50377752AEE43BDCDBC53ECB6E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.............NExif..MM.*.................>Q...........Q...........Q..........................C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....o.._A...G@.%....{.w...."y...E.|..#.YL/<....d..n...P...&.....n.]5.]....u.\..i..i.Z..a...R..l-.bTwm...P.T......m.......<.w{....t/...m4..4..>...J...>.pI...?.?n...c.{...o.^#..........G*[.i.........}....[C(`W.(...........y....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\IG2932CN.htm

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (58855), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):190493
                                                                                                                                                                                                    Entropy (8bit):5.4611499605752485
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2y3CzNFD4LWDoRLk/h5NyhwNuORAK/xYU:2qC34L3RLk/NyhEuN4xYU
                                                                                                                                                                                                    MD5:95D4B8BCCA66DFF4FF84C283C23FCF89
                                                                                                                                                                                                    SHA1:EFD5FC93F58C14D6A16D1669621C5D2DFC16B662
                                                                                                                                                                                                    SHA-256:C7D9CD080E609AB88ECE818292741B97BB1B4E59ACEA53801651A1702BD5ED35
                                                                                                                                                                                                    SHA-512:84D44C4B112B151896B66190BFE0135EAC0A9C809B8F0DD1EB384CFA3FF5A2841FD294697CBC69FDB3D0B9BEF3AA20095676A9B6A05C9E4D0BB7E65FF4BBA22B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,prg-visser,shp-xap-gr-noux,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,prg-1sw-sa-uiehacv2-ctally,prg-1sw-sa-qryan4t7,prg-1sw-p1size-i-c,prg-1sw-p1w-c,prg-cg-rr,1s-eaop1,prg-sh-badgewc,prg-fin-hl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-pbknc,prg-1sw-sap13nbrnc,prg-cg-uxprod,btie-brandsft-c,btie-aimclickbait-c,prg-mscl-hld,prg-msclck-rf,1s-fcrypt,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvc,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-iprc,prg-ctr-pnpc,prg-upsaip-w1-t,prg-upsaip-r-t,1s-rpssecautht,jj_fac_t,prg-pr2-cbdgendpt,prg-ad-article-h,prg-1cashback-astrov5-t,prg-1sw-shipfin,prg-1sw-enableact,prg-1sw-fnccombo,prg-2cashback-astrov5-t,1s-wpo-batchuup-tt,1s-wpo-batchuup,1s-wpo-pr2-ptasks,prg-ad-rpwns,1s-defaultscn,prg-1sw-pde0,1s-defaultscnw,prg-1sw-tbrcounter,1s-notifmapping,prg-sh-frnrc,prg-1sw-spnot2,p

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\ie-image[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 1260 x 293, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):39155
                                                                                                                                                                                                    Entropy (8bit):7.8985187905985486
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:c3+SnZXFurjYW0X0RJ/Dd18i72A/qcQ6Nj2CG+CiTZ2co4IXnmDt:DSnZXFuPSX0f837cQnCG+3WZXmx
                                                                                                                                                                                                    MD5:E161E2045A32E4513E81954B1D83B953
                                                                                                                                                                                                    SHA1:0A06306203C286B8C342CFD856C1EE3F16728C7E
                                                                                                                                                                                                    SHA-256:7A344D69BC6657592E6041F0ED4F53F56ABA90B97EBD94559198B1D059DC7F64
                                                                                                                                                                                                    SHA-512:7C7E5C2D2A0DF749BB4B52F2E8042829AE8ADD4F242674E13C14FEC436E56D7B173318D8408DD5A33462D38BC1FD2AD932B2060994B5A0C46F4B4BA89922437F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR.......%.....W.}^....pHYs.................sRGB.........gAMA......a.....IDATx.....diz..}.c._..W.7..Nc\..,@...]I w..")..DI+.!.6......A?2......pI`....{.........&.9...s2o...2Y5..0;.I{O..|.<.#...?. """""""".............&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\me[1].json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):92088
                                                                                                                                                                                                    Entropy (8bit):5.350496343927449
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:e+HPtQHzQPlhoRPIGNqY0gDZ9VT2kR3yoVE3qXU94GPrwhPYI48YLRQt5oRgvsHe:e+oZk8ykhPYIke02tqgXkSN
                                                                                                                                                                                                    MD5:869169588E9BE8BB97D6B15F8734E46A
                                                                                                                                                                                                    SHA1:466077AA989131C3A9D77CA5E5F1BDEBD0C110F0
                                                                                                                                                                                                    SHA-256:9B7FD2F7DA56BFC6FB0011B90521A09C49C5BEB0B8F50D5070683F4DFD61ADFF
                                                                                                                                                                                                    SHA-512:72C3D40E4E3FCD240227396619DBD2EE7861309329DB4255709A2F464A458CF37B8B207537B250D7AA8599BBA8D505BF236415E14445D480BD274DA207DBF420
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=d7d5f1d5-6585-455e-8a09-5878e6609026&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1jRrkS","type":"article","title":"Election disinformation takes a big leap with AI being used to deceive worldwide","abstract":"LONDON (AP) . Artificial intelligence is supercharging the threat of election disinformation worldwide, making it easy for anyone with a smartphone and a devious imagination to create fake . but convincing . content aimed at fooling voters. It marks a quantum leap from a few years ago, when creating phony photos, videos or audio clips required teams of

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\me[2].json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):92310
                                                                                                                                                                                                    Entropy (8bit):5.347299499019659
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:eeo8q+TA/qdEOaNjSv4/Sv49DSDmSv45jZCNmLJOLRI:ehrmv4av4Bm9v45jZCNmlc2
                                                                                                                                                                                                    MD5:ADAD91B4862ED53D76021774B3BB7439
                                                                                                                                                                                                    SHA1:AEB8B96D1D1F26A0A4E713755C1B05659177EC8B
                                                                                                                                                                                                    SHA-256:8D7B0C1C2C967E10A9BA9B19A0D6CD53B0C2AC4EA06088DAB0ED2F8746A22DDE
                                                                                                                                                                                                    SHA-512:89609530BBFEA13048A5CCF9D6D84D758CBB4DDFB3C0484D3D7F5A789591DF20262EECE41CA5B5F6BD38BF6706E1AA641FA457454EAA5F14E201CFDE32F0C742
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=5733c8cd-3cb1-4dea-a4c1-a23eedbc238c&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1jRrkS","type":"article","title":"Election disinformation takes a big leap with AI being used to deceive worldwide","abstract":"LONDON (AP) . Artificial intelligence is supercharging the threat of election disinformation worldwide, making it easy for anyone with a smartphone and a devious imagination to create fake . but convincing . content aimed at fooling voters. It marks a quantum leap from a few years ago, when creating phony photos, videos or audio clips required teams of

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\mobile-image[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 375 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):23972
                                                                                                                                                                                                    Entropy (8bit):7.983082688064765
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:OQCmhN3Hqqm87sSOvS8PJKCqedNV7TMzNjdpNQsjtHnUSQkBmSfYuoq9Dgt:dCmr3KqmIdO68MAnnWNjdpBSSQVfWDgt
                                                                                                                                                                                                    MD5:64C4757048F068394817EE126FDBA8A6
                                                                                                                                                                                                    SHA1:3610DC2EB5E3C09809E94BD0694A06C7A51580FF
                                                                                                                                                                                                    SHA-256:A9FEC8F56726ECA81D0600220A6B168FFF112A5283741FD5EC63509AEDBB51D5
                                                                                                                                                                                                    SHA-512:373EE45E16D231B2FF8A897A357A52A58B63430E0BCF728867879F2E10E55C631589D6F63C1675E2E40EB1EF7CEB59B15DF18013EA0F3FA352A3B36296F14DAB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...w.........o.lP....pHYs.................sRGB.........gAMA......a...]9IDATx..g.$Wv&....H_......n......1...g..r.IQg.]..?:gWG.;....s.#........;.!....a`f..n.h...].dV...{.......j.C........|..}......................G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 .8lh...5.Hn.R......j'R.;|j!..I\7...Z..G...BhB.<}.....G..X..-...w"..]f.v~..+.HI...#._.k.S.k!t...n..;...6..`...G...L...../...1...Hz..:.....j........a.."..M...(..u.L..+m.3.">....i..pq..v.!..p...m7.gH\.v.{.....j,@...w:@.......v.....>).w.......G.r..LKmE.@........K...v0^........v..b...ja....@t`..u.......{D...}./}...}g.NN. 6..]...PS2.q.Ge<..v ..D....B..B.V...D!.T...@>G.....u.m4.Z.XZ.\X...j..F.Y@.... .."z....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th95I0N1MO.jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):17551
                                                                                                                                                                                                    Entropy (8bit):7.965959023970738
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:S517nVuxEXYp4BjFL+r9gm7x3mgeE3z+WFlJc4q1m:S3VcVOyrZP136WFfvv
                                                                                                                                                                                                    MD5:58058A7B317F1485439CA716088E70CA
                                                                                                                                                                                                    SHA1:C11747ED44E7CC2FD5A8759F2350306DA81504BF
                                                                                                                                                                                                    SHA-256:F14AD7D89B228DE0DAC8E8513501FA9A0927B2632D0263E07171A282E84AEBDB
                                                                                                                                                                                                    SHA-512:7C0AE33E6684C419018BFC7E470196D596EAA141E4019C43E5F98D32293553717012C0C09C3BAD0332E84716592648590FA020EE046FF7AA4E5FFB7D6E82CD40
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...O...[[;k.<.3..q...}.Z]...Kg..t..uVFe.U....-..&.......K...=.?y.p.......I..3....I..."t&..P+..G.eb.I.Q.Ss..SM.?x..BI.&O...w.........[.XW,...2.....2}M.....P.8.Sq..=$.....4.MD.S..X.2i)...9zR.q.K.Tl...0.@.1.Zd.pj.'.j..F.MR@K.s.?...>.$..b.....d,.....W#...U..7. $.(.7<c...O......@..I.9.....>....4........X..4...v.#]3.X>........X..LR/....e.kJI]..xCD.w..po$.c....s\...h

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[10].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):8480
                                                                                                                                                                                                    Entropy (8bit):7.935082498878961
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SzM7xycrtsl7YAIqQGKPpN2jFFXEqwhjKluGe0DAle:SoycLAIxGKPOjH0R2gnle
                                                                                                                                                                                                    MD5:022ACCFC632E0936E9A369BCBB77F5EC
                                                                                                                                                                                                    SHA1:B2F3455CE4CAAEE04477BEAEF58FEF4FF8AADFB6
                                                                                                                                                                                                    SHA-256:EA7DACE88C4ACD4E458CBBF7CBF610D347DC6A0394E13419805CFB5BA6AB6600
                                                                                                                                                                                                    SHA-512:DE5B9C0F2A4B5D6AA5AD4BE51A87AF2F9EBC6FFECFE15FD8061163A0FC02AA8B43CC24FB8398F402B5DD259A5F4E4AFE009657CFC88384FEB916BF0827666D7C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..[.R...$g.....9.(cR`..Rm>......:T..u..Jp.@..wr)..@E5A.K.@..}).....8....\..tmz.R_..>.....{.O&.m^00.....G. .q...c;g..............5.w......Y]&.9GX.^...#.]".....?.!..(...O..S[w.-#..k..Zi.;p....4.......1THH.QQ.'.I3....:P.3d.5.9..y........UL[[u\...R...#.L.T....@..?..(...[.Td..#fm....$.......1...+..RL.G&.]\F....F.guW.D.\~uF..~z../......^.....#.....zU.......@%....]...V

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):60900
                                                                                                                                                                                                    Entropy (8bit):7.970135075309218
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:RK3Gi6lV89oaNcZb0hyWwA+EypQ3SwVVTdAWBaoIzihUYJbRzjI:i4SawjyPA+Eyi3ScnAoIzxYJBjI
                                                                                                                                                                                                    MD5:FF31E493D94952B269DE1884AC80AE27
                                                                                                                                                                                                    SHA1:26132D5E5D15817A6F5658B51EF3CB3C51DC8BB7
                                                                                                                                                                                                    SHA-256:C13D09A0AD8D4E4F45423256DB0DEAD5D377A83D999F3CEB1FAB297FF865BCBF
                                                                                                                                                                                                    SHA-512:84449CF340D00E8AA906088EABF41729FDF6A8AE7E7FA8C96316E90ABCC7F014BD48F872F160F04204928981B1887987F51FEEBB64E85D0A90E769D67EE35BE0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....=.l.A..T..I...'.H.q'.k...v.N....i.M.=.....a.R..pGL..j.#...x~m_.W...Z[...$.....C.g.f..n|w..;S...r...g.... .......Z.\..]N.Zj..N....C..s.~..n^I.=..~.%..0!.\s]..]hi^5...`b."7c..0..S.._.Mg$.g..!.mDa....Y.t.) .N+%l..<C>....x.n.|..$......a].>1.r..N...a.R...o!D.<...N[.. }+..:......y<.<....:.kXDO*+.I.b.,...%.j].......n..jt..zT.,l<.Rk.J1.:U...N*...:.Mfv......

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[2].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12348
                                                                                                                                                                                                    Entropy (8bit):7.9531684691073306
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SQwaE0pWbHx1IwAbZ1ihJS7x95jP6vR179u9c65:SEBAHx1HA1SG9U9X65
                                                                                                                                                                                                    MD5:E79F0949A8EB715895A012E3D6B21162
                                                                                                                                                                                                    SHA1:F927F8BE269D55DD8C3C60AEB06DA47682865D8D
                                                                                                                                                                                                    SHA-256:A36731AC657C5CF8403ECEADA18BA1FE5295C38DAE1094C88D9C2E1572F18F70
                                                                                                                                                                                                    SHA-512:24BCF9E02A032E971A55518CB70742C07E94572E66A5A99ECB5BD29901D2AF98FEB9D7B088854C8D7DB716B71FE5834F1A828B43962F09E777817171E6AA4162
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......e.a.8..5..Y....R\..t..@s.Ag$.^c c..5.H.-.6z....e..({.......9`pkOy..k.XLe...>.Z..6..1e...=...fs.J...Y..O..h.5....l..RFn2}...<..rFj..]E..,.S..!......t.42.>U.3.u>.JH.T.......k..y,..crg..Mn..H..V.....B.).......c.U.t.b....T.Y.Fm...3.Qtd...S...x.i.ZB id.....v.`{.d....*.i.2.2!8...v3Y>jLsK..=P...a.O*..:.5...]N.q.M"yYSi.....|..;z.p..g.,j.h..?..4..y4..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[3].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20050
                                                                                                                                                                                                    Entropy (8bit):7.966721450235251
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SQDLbv2tqepmflMr+hu+YFv/XxWWfjxsq1exluiK9DECZeeQB/LDDX2blJE7:S2v2UNC6hu3B/x9jJ1GxkDECg5/nsJc
                                                                                                                                                                                                    MD5:704A514FC51D3C5BBBBBD8D9D68FD5BF
                                                                                                                                                                                                    SHA1:7EF79247A00ADA32B7E123407AD631C017367663
                                                                                                                                                                                                    SHA-256:936E66CC492C37F4369C3C7FA736333651DE79F25C4433C7CB4D3E0008CBD973
                                                                                                                                                                                                    SHA-512:D2E10F6BF09B1F074BF02F4DF612143316DFB104163D7694516192B85044BC36C46CCFE9839EDA88476ED72D0FCF3CCE4808ADDA77BC6CD039CA3D370770163C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........a.lJ..=*6.....f(#.9U.._kc... .jw.\..Q.......s.R...(`..s...jX.m...!b.2.H....,|t.qX.3...q.V..p).....ZE..:9IoJ...B..`Y..O....N..sV...,../..5<2..U..m.jd9...C...u.i"..i.........`.~.......^..$.S$0.QK.Hfb......J....KK=pAq<a,..b.yj..6...l..N+.n.U....+.q...cn......N9.c)..;k.../L.....d..[..a6...'..U[3..X.......3...m.2....=:..'...._H......D..z1..8..{S.Mz..#L..Y

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[4].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):29908
                                                                                                                                                                                                    Entropy (8bit):7.940507266165066
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:S185aJT9eoHOC0rTPa4ZM12LrgFeCorBSTfF:Ssa59LP0BK1AyZoe
                                                                                                                                                                                                    MD5:4786358A8D2583643CB11C72450B0511
                                                                                                                                                                                                    SHA1:29C7EED9217379FDCB22786A29C62C08537F0945
                                                                                                                                                                                                    SHA-256:A342C32EB9F566BACE1E74AFD750828FF663C3940F3B430D4B47B60C79B4FB93
                                                                                                                                                                                                    SHA-512:40264466171D2524FFF1A4E0A51595039E10D7181526BBA38B9721EB657A5B838E6233CDA8E29F707889A7FBC6CD77E5F485A72F71F55175E14196CA9A650E09
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....:....\x..v.7......0..Z$..S;.....=:sRx7........V.4-m<..+....WV...H^L6...P.e.x.1.P.1....JY>%.E...K...Z..(...>c..t.......'.:.5....v....-......)"..JF...d.U.}.*<.).KO.5..5.xJ.!........-t.V.u*@O7.G$...W.#..A..t.M...qD..#.!.1K.>.0....s..6......#.....q.U..J.I..uU...H~M..J..$.6.<.;f..E.h&...F..a/m._....u.-.e....5..*.u]G_.T.M..M.....v..0H...V............p5.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[5].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21603
                                                                                                                                                                                                    Entropy (8bit):7.966512295426093
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SywBUGqD9Qv6LD4lTNv6B5kOLSgNQuQZTi5pWB2v8G1eHSS8L78C/CtpI2Vrs/:SywqGU9CwIsB5v+i1QE5pWBG8MeHSZog
                                                                                                                                                                                                    MD5:BF63BAA0466800BCA57EE03C1389FD7A
                                                                                                                                                                                                    SHA1:26B8CB28782EE9C3B3C922F82B11CB8481246602
                                                                                                                                                                                                    SHA-256:FAF5450D99EED67490D9C7A7EBDEB58CA4BF55A646ED73230859EA59EDECACB1
                                                                                                                                                                                                    SHA-512:3254222B055D7DE6843801AAA95231DAA158397BDEFEA75B3116FB7B60C68684C40F79789EE454AF73E90C0CF72C5E895B8BB8E9E997E8BC5583003E3D8396E7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......9x.r7.>....l|.q(.RB.M....Fz.8..u..:~......U`.[...z(..v....j.j.._...m.............z..m..ryN.I........b7.HY......GLdt#.E"./..t.RnZ_9.....?N.....s.Z...K.i.!|..c.'.:........*nsP]].b...[y!.&!.X.7....9.....k..mcK.....<."*G\.....^...;.G....ks(..@...H.V.+...T..+..!........v....n ...ts..2..J....x.U..7...$..oS..p.:.jC.j......[E....U{lF..*..8..;.z.&.6,.C..6npN

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[6].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13927
                                                                                                                                                                                                    Entropy (8bit):7.962117837773362
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SyNian1J0KIViTODDJ+ESKnXEiS/HdfHxRMnL:Sy8W1J0KI4TOvJpXEiS/9fHc
                                                                                                                                                                                                    MD5:82B8C2BB1EA2414CB52B5186BCFEE00C
                                                                                                                                                                                                    SHA1:0DE9636E7460C7DBA0A5DA84A3E7B488D7652657
                                                                                                                                                                                                    SHA-256:1BCCB0F2EE8E8A15D03F669FA1F1F94FB83DDB05239473C568E844B7AAE993DF
                                                                                                                                                                                                    SHA-512:9F77F07AB8B6AF2B6FA462433117BA72A9A218C18B2847901EDC99038A0B6D60A6858EE697682B87D43BF73A81CC327F77C52646981C80BC08EF99934F989B0A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..J@O..Qn.L....C...g.:*(+.....:T..N...?n.....][..'o....Pa.<J.1..N.)..+.U...@..hU...;..8..o..V..[...mCu..lx...j..G..g.N..@....C#......*..f.Y...h.........k...j..C...'....a.......R!'.hk.{..K._\....P.~ ..&..<}...1..UW.b..)lc.2.P..i.I;.6..,mefH.I..d....v..<....!.G.>N?.9..[R.Z.....q...3...>j.=...r}+..~.|C./y.i:.....|.1.G...B...{...2O.p.v.Z..[\.....J.]O.<..:

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[7].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12574
                                                                                                                                                                                                    Entropy (8bit):7.955483338685417
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SFQv2T0Rjee+UOMM2OECTifEvTFRCQlB/+MYQnFmSEgTEeT0iPz:SFI2Eee+mMBEGigFlxYQmpgTb0c
                                                                                                                                                                                                    MD5:AC72FCC12CD3B11A965E10E19916407B
                                                                                                                                                                                                    SHA1:57F2FEDD16C87AEC57762E8E084E1E8351B86652
                                                                                                                                                                                                    SHA-256:FDAD89F0645A2F5006462722179898C888BC429DF28A820D20B1858D713747EB
                                                                                                                                                                                                    SHA-512:38FBB8102C6DB632F69A99EF58E8ECBAB057768709E8C7722D9637589D76FB0217DDA8332B0B91C2E5BDF604CB29AF0DCCB70DA4AB42918673EF772513F06AC2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..c..<...a...o...Q.....z.......~/....<.W#.."20.V..g..H...\.5.[[..$W58.h..trv.Ol...I..t....y.".]Y*..,=. .+s.{s..j....[. .,g..mb..wRk.R.0..,M......{.w..s....J.?6.+>.V.#&...Z...T......}N..'.....~rH...Sm=..j.K....-.w.O9......[.....3^..].6..u`3.V..<...Z.........._f..p1.+..N...s....._....5.i........]oO...J.;g8.I..u.c..[.....R.t.U.D...E..@.|.....q7R.v.g..6.&.K.k..a

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[8].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):20873
                                                                                                                                                                                                    Entropy (8bit):7.963140674615213
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:S2Ey6w6VsGqB+86YIYtJj2jEid9lq0FJH7DhuoHAnJniw5:S3AJQ8LV2IsffjHvriiu
                                                                                                                                                                                                    MD5:0F2E07A8451676B3106422CA6299B184
                                                                                                                                                                                                    SHA1:A99F52CCB4F86152F2A9D40ADBDDEBAF5C9E8B0C
                                                                                                                                                                                                    SHA-256:2787BBB12E97205A6BB6B59755A90A338E04FEEEC66EFCDD5F26678629F21F38
                                                                                                                                                                                                    SHA-512:45A8C00EF717C65CC8C44FC868D9D691CDF02FEADECAD1F55691B755921C0A47D6F4A3C3AFB0207E686B3595009A1A09637DB14AC5CF8636BCA777D895388B77
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...?.h.I..u.3.+.\....;=M.p.[_mn.Y....T.M:...j.[.iV.T.O..FI.k;I.....ug.7.b".....k.....0...~w=..P.[..#.Vr..q...\......|ag.C.7..\.q..C6?.Uk.~{........6..pQ...^k.>. ..Z.O_....g..5...5<..X..=b.(...X......k...Bp.S.].......Y^......@.....................K..G.jA............\Cj..6......Jl:....3A.=7N..5M.y.yU.?....Q.M.._..>...Z.+.E......Y..u..S.[G|....V....m.,7.p..anW...

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8ITCWBID\th[9].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):21611
                                                                                                                                                                                                    Entropy (8bit):7.959212457330467
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SxGDoEYLOKhD4uu/A8y41keiFYLzSlDqlXE8tltT9kv0UKEjXaiM+r3RBPJ/:Sxc0hD4uukeCO02tTy0yXfL7PN
                                                                                                                                                                                                    MD5:8FF0048FFEA3A12547F55760D76A7F3F
                                                                                                                                                                                                    SHA1:C9529154BEF7399087A5345A3E07B5E19C4C08EF
                                                                                                                                                                                                    SHA-256:1D2CED7DFF0DA95A5A031E23FA82BE0D851BE3B6DCFEA8A35AD682E2AA4BC73B
                                                                                                                                                                                                    SHA-512:402B560B2E9C54DC7D533BB37DE3AED5412680C8DFD08B9C826F5E5F233A60CD667D2AEC37ACD6E286C95365B16F4E91B13DC32A14475AFFFFC517AC0485264F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..J..&Z.D..$<..A...z..(..p)......?....+......2v.........[vY../L.$...I....qL......7..].........<.....M.G.D.C1.K..xc....y...'.R.f..[y.yL....B.9....Fp.3K..g......L...5..!..qt..n....qYJ.c.f.)kc...w,jl.h.....c.|..v..M"...am.._.u..i.....x.K..!.o...`............O\We.X..n...._9 ..l.zSU.i"eJQM.A.4e....6o.1.8.=.3W..n.O......D.K.....j.K...2...)Vo.`...b...}.Z{X..7..p.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\AA10QAZe[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 275x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):6.711996485767956
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:FI9kc/1UGNCyluNqq0SPrZ7u56uRf9cgQ5j:FGdUZyluNq3aZ71Gf9cgQZ
                                                                                                                                                                                                    MD5:01FA4C58E0E73B9C80F6D7F5D82E0415
                                                                                                                                                                                                    SHA1:53493A2E6349B9D033AA529BE13292929AA4A083
                                                                                                                                                                                                    SHA-256:438FD5C271BE5FA32889D99A7F97280D764CA34A83E509C8BEECCCCD31BB76A6
                                                                                                                                                                                                    SHA-512:E2418BA0F9B7C1434E7E75013D305F8D5B99B9FE57BCD31B1CF084D32AA79813DB04EBCEE24DC70598A5AB093512A8E0A4E1B032BC36A556FE46B025EA66BD68
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`............................................................................................................................................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....z......;.4....-..a....i...b...P.q..ZV..R@&.C..-H...a..."(,...@.I.@./.^..<3.6..|&c..........+{.r...n......x.......+...]....Hm.H...:q.'.z.E.&...!..y.}WW........Yev....T...5..c}5..Mm...!......f..z...?h........<.@.-...?A'#.5?.^...O.#..,<Ky....H.[.!V..~........J.....>..E....+...A...&h.M..}...Z.2h.(...!...u.....!'...b.2..j.(.(..w.=h(;.1.4.(..h....K`..KP... ._.X.i0.8.............

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\AA1md5qf[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 300 x 157, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):68226
                                                                                                                                                                                                    Entropy (8bit):4.959739580335679
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:7inNt2J9v3/sNjhiVb2f1EdPBq2y+Ce7x6GrheHNBnh:uzesNtiVbS1EeKXlP9i
                                                                                                                                                                                                    MD5:D758A4D3C931CAD8EF0B73C7D69AF611
                                                                                                                                                                                                    SHA1:3A6BB6F8970AEEA8B5083DACDD6821D33C30F28F
                                                                                                                                                                                                    SHA-256:E8D0BEA18834B33660AEE69D84FA9D81C90F14A81A2DE0A9FFDDF4B863BF0B75
                                                                                                                                                                                                    SHA-512:B2548804638C76EA28F6FB7F7667F014E4E7D44C3735F6096A85EA9AA9CDFCAA27F4C5EFF2AB8FCEF20EC150BE2F3276AADF2DEF798A747AB4B0FB6C7A1C0C20
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR...,...........E.....pHYs..........+......IDATx....&iU...}o.{.v.t......!..+H....0..UTTt.U?"."....u./......"A%..&....nw.|...~.Su.N3CX..q..oU=....s.s..D..6.#.@;.g...XmhG...v...#...=.1..lG...G....=hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{....u.yTmG..hG.....hG...{.....y<..<....pz.0...L....h..@;...#......N'.....wFL\..../G..?.1X.N..c.+d.U.....6...v.>..h.....F..h..zJ..G...C.).%.......I......lT... .$.v2........&.0k..<..q../..#p...........Nt6?=......:.N.K..X2.V..q.&9..1~A..9.Z..u.+.....9_.C.....-.js.^..`9:q.Ck.*G..iG`m.Z.Z...N.....,.S...U.$9...N.U.V..p@.L\W..M2..Y'9..\.z.F."6..6.`.z.p.K.l8.K....!n.bf..%.&...:....d.^sR.b..mr..v..c.@.Xw......K.R.......z..[....ED..qLp.#....IP|$TpX....'.....Yw.s._...+.(nV..:]..V.....w...A.....<]..C[.......M......#...]<..x1.N@..1@.dtGv.^.r.X.. .pbd

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\AA42cl9[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):371
                                                                                                                                                                                                    Entropy (8bit):6.771619399520493
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:6v/lhPysQHMkXXgjnDi3URj9DxFeT/wfqddXWNtaQAwx20SHdEqfgeB3ScVp:6v/7wH83nDDeTYwmKQLMBYeB3Z
                                                                                                                                                                                                    MD5:6CC41C487BA6D1FA16A058E7F15604B0
                                                                                                                                                                                                    SHA1:C02C61F59349DED8B2429AD68F6530C34334696C
                                                                                                                                                                                                    SHA-256:759513794817F448B8F7FE0A14A246062CBAC036A64CB6B5A856B38518AEA5F0
                                                                                                                                                                                                    SHA-512:2AB595338D17E63D06F972DF1A03BE3834A5AC688F8BA698B8FAA05BDFC918316926D7B29F70C155C7708E7E19264F86E1D3897BF3D59018B9CD54A6D0B82539
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs...........~.....tEXtCreation Time.09/28/12.$.Q....tEXtSoftware.Adobe Fireworks CS6......IDAT8..S...0.. ...... #d...N..:B7.:A<BF....x ...B...I...... ...7.."p|Lx.k3C.yW........:..TU.`..fF....s.R..u.4MOoTyP.G.9.m..=x..I.)"U....eA.. .UE.w...I..0.#......O=...f.........PJ..y...SJL)1.X.....N..r.B.....IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\BBERG9W[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1622
                                                                                                                                                                                                    Entropy (8bit):7.2063127622287535
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:U1hfvWwjx82lY2T3JVdpz4lpzayJ3VrpzB/pzfGtok3xWZezJLNKhhNXoYcrpbeT:aANn2NlzuzhJ3rzbzfPIxV5kh94eZfx/
                                                                                                                                                                                                    MD5:7B1B36B2F81E70D9C22B34EA45D2579D
                                                                                                                                                                                                    SHA1:E10ACB0952A31731F38D34AF1C02CD121784057B
                                                                                                                                                                                                    SHA-256:A73D67096CCF12F95814A2D275D992A00DA57A4A5406A76BA09A453A8B42338E
                                                                                                                                                                                                    SHA-512:CD23B852289F89729FB61FAE185E8CA26E86AAF128898FDD339EF6AF1AAD77A2D8EEEAA4B93C8A9687DBA73242A799601E6D2AD0C89E66C5C3F96ACFDAE42231
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Windows)" xmpMM:InstanceID="xmp.iid:D3DE4F21C79A11E7BCDCA837188533D6" xmpMM:DocumentID="xmp.did:D3DE4F22C79A11E7BCDCA837188533D6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3DE4F1FC79A11E7BCDCA837188533D6" stRef:documentID="xmp.did:D3DE4F20C79A11E7BCDCA837188533D6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.9.g....IDATx.lS]H.Q....]w.u.7..R. +.Q$..z._*.2..G)..|...%.0.%(L..'...D.!.(.P.Q..u.......;..&....;.|....|....j.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\BBI4MeJ[1].json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5289
                                                                                                                                                                                                    Entropy (8bit):5.301084432781366
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:YYP1roA+cBKXFFciVKIqHuqKXFjRklVKIqHuqZcDInY41FsIVKIqHuqo4zHVxIqS:rocBCevC6WZcDgSIs9HACqc8Z7DgDid
                                                                                                                                                                                                    MD5:E084C31907683F9AFFD72E819DEAD1D6
                                                                                                                                                                                                    SHA1:59CD1C5A5A88CD539E36F54E89C9D10A489A9012
                                                                                                                                                                                                    SHA-256:0D46B65C7260B11787DE949D6E12B66A19522F10E2176F2A7D983B9FBE473E13
                                                                                                                                                                                                    SHA-512:8691A7515B7F011E6C598E383DA9B25FBFF00A1D6F1F280FA15A150C6E29742106CDDEE43AE0FD5E733F35CC633A77AF39333E05C734E969FEC749E7F33AE28E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"$type":"list","title":"","_isPublishingLocked":false,"_id":"BBI4MeJ","_name":"MGXStoreWebPromo (old Backfill list - DO NOT DELETE)","_sourceMetering":{"isMetered":false},"_lastEditedDateTime":"2024-03-12T19:52:34Z","_links":{"self":[{"href":"cms/api/amp/list/BBI4MeJ"}],"parent":[{"href":"cms/api/amp/section/BBREXz4"}],"children":[],"feed":[],"provider":[],"references":[{"href":"cms/api/amp/image/AA1i0jET"},{"href":"cms/api/amp/image/AA1elCIp"},{"href":"cms/api/amp/image/AA10QAZe"},{"href":"cms/api/amp/image/AA1md5qf"},{"href":"cms/api/amp/image/AA19yQae"},{"href":"cms/api/amp/image/AA12PRKq"}],"section":[]},"tagEvaluationGroups":{"_tagsHash":"3145739","tags":[],"vectors":[]},"_locale":"en-us","sourceId":"BBlbsHE","keywords":[],"facets":[],"labels":{"category":[]},"list":[{"link":{"href":"https://www.lendingtree.com/?splitterid=home-equity&cproduct=homeequity&cchannel=content&csource=tradingdesk&esourceid=6475206&mtaid=2D09E&rcode=10000&s2=borrow25k164_flagsidewalk&ctype=sponsored30&c

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\BBNvr53[1].png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):592
                                                                                                                                                                                                    Entropy (8bit):7.578589676001941
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:6v/78+QOTZD7cechojiorckcpFwDSAFGSEpMFC2Cmw8qTavN+M8MIQ7LLiQp:jsZbchoj/4peK6FDBwQV98gP/
                                                                                                                                                                                                    MD5:4124D5FD304564D77589DED83FE598BF
                                                                                                                                                                                                    SHA1:8AC689BD506AF7312E8FBB06AF3A215B9A609A23
                                                                                                                                                                                                    SHA-256:BA66F541FD81AC7C99D86BAC4CF071C9F0000F408B7487AFC1BD5E35E20B87FC
                                                                                                                                                                                                    SHA-512:4F490E4ADE3C0AE6C117C92BDF8266D29D1B1FB2A80510EFD447BA228B9939DF3C70320FBB5ACF1CE6B2D5646B6CC45EB2C45DC7D26CB28C002CC4C145016BFC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR................a....gAMA......a.....IDAT8....kTQ....e.IX...F!Z...H...`'.....`ai...`!v1....(.`t....V#Y\.....5Q..y... ...f..{.{..v#.$K..1..i....U.\t.[\s.trB..v.v..4kU?._...&.l.Qy.n%..n...V}..Q....)......q5.W.U..-...N..S....>..a..l.....`a._..d..q2..c.G...0........xl'\.......1b..UP...BF.v.h^.....:..v....VU..MQL......[...w.awV.._....+...T.<o^.z..'..vt..AI09..9..J....U.Y]...7.Q..@......!...v3)y.z.....>......T.WuF...H....U...g%e..<y.....b.O.6.]7l.5/...o.E?(.5..]..;..1..?..H.t.D.u?...........Y.0..v.ii+y.:..B.2.Z.j.{...R...u..[......r....IEND.B`.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\W4C87BS5.htm

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (59037), with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):190311
                                                                                                                                                                                                    Entropy (8bit):5.459448503318283
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2ycwzNFD4LWDoRLk/h5NyhwNuORAK/xYU:2Zw34L3RLk/NyhEuN4xYU
                                                                                                                                                                                                    MD5:1164DE01AFFFD2E7139CB5CCDD423636
                                                                                                                                                                                                    SHA1:EA7C08F9CAD3B7A433459638CA97E433858DB594
                                                                                                                                                                                                    SHA-256:D467201B812E23EC96E82C2B963E2D8089A6C0784013714E279E180B7A825F4F
                                                                                                                                                                                                    SHA-512:FF71A20DAB8EADB4FD71377996F2A4F89C09E058DD5254A04925FEE42AD42D229D64F98EEA84A064426676094773B2FBE7E71D9137C3820B0581B1FC38DA81BB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-tat-msnvserp-t,1s-msntovserp,prg-visser,shp-xap-gr-noux,prg-sh-enitlea,prg-sh-enitleactt,prg-sh-genreco,prg-sh-genrecocreative,prg-sh-genrecosubkeytest,prg-1sw-sa-uiehacv2-ctally,prg-1sw-sa-qryan4t7,prg-1sw-p1size-i-c,prg-1sw-p1w-c,prg-cg-rr,1s-eaop1,prg-sh-badgewc,prg-fin-hl,btrecenus,iframeflex,prg-adspeek,1s-winauthservice,1s-ntf-pbknc,prg-1sw-sap13nbrnc,prg-cg-uxprod,btie-brandsft-c,btie-aimclickbait-c,prg-mscl-hld,prg-msclck-rf,1s-fcrypt,1s-p1-bnw6,prg-1sw-sa-bnw6,1s-ntf1-fyrvc,prg-1sw-sa-fyrvt2,prg-1sw-ccl2-iprc,prg-ctr-pnpc,prg-upsaip-w1-t,prg-upsaip-r-t,1s-rpssecautht,jj_fac_t,prg-pr2-cbdgendpt,prg-ad-article-h,prg-1cashback-astrov5-t,prg-1sw-shipfin,prg-1sw-enableact,prg-1sw-fnccombo,prg-2cashback-astrov5-t,1s-wpo-batchuup-tt,1s-wpo-batchuup,1s-wpo-pr2-ptasks,prg-ad-rpwns,1s-defaultscn,prg-1sw-pde0,1s-defaultscnw,prg-1sw-tbrcounter,1s-notifmapping,prg-sh-frnrc,prg-1sw-spnot2,p

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\common.3864859aea200a56092d[1].js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):285935
                                                                                                                                                                                                    Entropy (8bit):5.423812349396232
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:jGHopYqziV76+YrGW8yhxlFQ/uMBwX1KSU:jSoKeiV2NrGVuMvb
                                                                                                                                                                                                    MD5:D98F620892FCC7698665E9EB43168F9B
                                                                                                                                                                                                    SHA1:675B74FBAF006D295DC82317519788D526CC8C60
                                                                                                                                                                                                    SHA-256:93B6652EDADF118219BB4F0781A17F15CE3D7B349FA0F1011BDB0B5224C94ED8
                                                                                                                                                                                                    SHA-512:06EF77D6802FC8D4BA2D6BB1F96519A7EFEFEC177415252CE3CB2D01643427FEF131A27F9AFF59DB299E73F01AA8D206E459B8C63C574318D9385AB6894481E1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["common"],{54085:function(e,t,n){var r;n.d(t,{p:function(){return r}}),function(e){e.Desktop="desktop",e.Phone="phone",e.Tablet="tablet"}(r||(r={}))},21290:function(e,t,n){n.d(t,{GB:function(){return u},Km:function(){return l},Oq:function(){return v},Sp:function(){return g},Wc:function(){return d},_d:function(){return p},cm:function(){return h},e_:function(){return b},kJ:function(){return c},oH:function(){return m},r7:function(){return a},yG:function(){return s},yL:function(){return f}});var r=n(33184),i=r.z.Alert,o={build:""};function a(e){Object.assign(o,e)}var s={id:22010,severity:i,pb:o},c={id:22011,severity:i,pb:o},u={id:22012,severity:i,pb:o},l={id:22014,severity:r.z.Critical,pb:o},p=(r.z.NoAlert,{id:22021,severity:i,pb:o}),d=(r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,{id:22027,severity:r.z.Critical,pb:o}),f=(r.z.Critical,r.z.Critical,{id:22031,sever

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\experience.1287eb605f92d676502d[1].js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with very long lines (62058), with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):234686
                                                                                                                                                                                                    Entropy (8bit):5.768283217926616
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:r7c/ckbS2b/pVQAWjhw3d3qWnQHdRJg7hJ5BjHnatGJNyWVzskPNjlqAGu/gzxKb:fvkbPug9MmyWsard/KJb1rNA
                                                                                                                                                                                                    MD5:6AAE93A7CCE3FE8BC016C5F4831472DC
                                                                                                                                                                                                    SHA1:5FC3CE2919A27837CD1848084413E965D658A645
                                                                                                                                                                                                    SHA-256:B650CAE4BA73157B7C226CBF03D86804774B35563BA24B79AF644BD45F749FBD
                                                                                                                                                                                                    SHA-512:ADD7B13ABE7B2AA799263217AAD8806C607B3D384E151C69E47F81585D15C637FC16C4679A258393AF6FF89E26325AB61F5FE06278A5A7CC1996BB74EF412042
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:!function(){"use strict";var t,e,n,r={12451:function(t,e,n){var r=n(8460),i=n(2132),a=n(82589),o=n(9925),s=n(96838),c=n(56595),l=n(54616),d=n(82512),u=n(98182),f=n(8488),p=n(30786),m=n(4108),g=n(23159),h=n(65212),v=n(87738),b=n(54085),x=n(3460),y=n(91898),w=n(42390),k=function(){function t(){}return t.trackCallbacks=function(){switch((0,x.Bn)().currentColumnArrangement){case y.K$.c1:case y.K$.c2:t.viewType="size2column";break;case y.K$.c3:t.viewType="size3column";break;case y.K$.c4:t.viewType="size4column"}return t.viewType},t.getTelemetryProperties=function(t,e){var n=!("false"===w.c.getQueryParameterByName("enableTrack",e)),r=w.c.getQueryParameterByName("ocid",e)||"hpmsn",i=u.jG.ActivityIdLowerCaseNoHypens,a="0",o=!1;if(d.Al&&d.Al.ClientSettings){var s=d.Al.ClientSettings;"true"===s.static_page&&(o=!0),a=s.browser&&"true"===s.browser.ismobile||s.deviceFormFactor===b.p.Phone?"1":"0"}var c=u.jG.CurrentRequestTargetScope&&u.jG.CurrentRequestTargetScope.pageExperiments?u.jG.CurrentReques

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\microsoft.afc9b4502f5cf6f88cca[1].js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (65448)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):94620
                                                                                                                                                                                                    Entropy (8bit):5.4076498069548435
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:wYqLAnwLD2AFtbo2k3DG5wsxWkNcdJ/r3LLnt9+tISGtOMHiYnEvlwXLnt+79VlU:w7L37ivM1WkNWnt4KClwXLwsoxsE+
                                                                                                                                                                                                    MD5:095130BBC3EEC571FCE0F8B59513E250
                                                                                                                                                                                                    SHA1:391DFF8E9455FA291AF53500A60BC955B4E586A8
                                                                                                                                                                                                    SHA-256:F834D3999811C38EACD96A27AFC0B913B38E84BB68D14D3F6DDF815C7D1ECB3D
                                                                                                                                                                                                    SHA-512:35101C2CD26FFF76719977B4A99D769A0713B23BF874E43649F4EB6699E0A01BA74435A870C7C02B56DA1C928417B66EEE019B9B1ED3752F06C95CA8770D3E1F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:/*! For license information please see microsoft.afc9b4502f5cf6f88cca.js.LICENSE.txt */."use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["microsoft"],{39115:function(n,e,t){t.d(e,{Z:function(){return M}});var r=t(68897),i=t(44611),o=t(89734),u=t(98693),a=t(38629),c=t(64648),f=t(73966),s=t(64973),l=t(26105),d=t(46540),v=500,p="Channel has invalid priority - ";function g(n,e,t){e&&(0,f.kJ)(e)&&e[c.R5]>0&&(e=e.sort((function(n,e){return n[s.yi]-e[s.yi]})),(0,f.tO)(e,(function(n){n[s.yi]<v&&(0,f._y)(p+n[c.pZ])})),n[c.MW]({queue:(0,f.FL)(e),chain:(0,l.jV)(e,t[c.TC],t)}))}var h=t(27218),m=t(24200),y=t(92687),S=t(28055),b=function(n){function e(){var t,r,a=n.call(this)||this;function l(){t=0,r=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,l(),(0,i.Z)(e,a,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.MW](e),{remove:function(){(0,f.tO)(r,(function(n,t){if(n.id===e.id)retur

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[1].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                                    Entropy (8bit):7.952821839294433
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SfWbWN3VEs9rODumvvazYXElN49H3cOgR0DpfUFOGfy8VUb0lZjzV:SCWN3Z9KtFEluHs3EWOSy8GglZd
                                                                                                                                                                                                    MD5:F3416899E7FC246E955F229517612168
                                                                                                                                                                                                    SHA1:DE1ACE61A8FCA60939D2BBB1A6AC829C22255EFD
                                                                                                                                                                                                    SHA-256:3AC5E43DBC1177DE25EFB29CCE3C08062AB77FD5A07EB7D748DB1BAD66E4E8FE
                                                                                                                                                                                                    SHA-512:FFE5C3CE0486D07586CB67A0C74A08388CD6F271FC411F7FF7D15BAFB8A50F7E7BA87190E7FAD9218E2A6441692A2C4F4A9ECD82CD7B7018E12A066C31201CF6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......kyv.T...n;.....v...{V....>E..f>A#9>.`.L..$...F,.y..tI++.i.a.;..G.W..L..N3..J.........C.B*..\i.F.L0i.9..EQ....t..H.[....V......O....\.V..r..jxn..8........j.....c.xh....PNI5"}k...:j.0\g.....m.......^..(.2<.......O.*....7........K.....aq..}/............._...!.~....G..i.|.G2-q'..70.N./#..`h....QE..QE..QE..QE..QE..QE..S.<..z.sZ.....;k&...n..H.'.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[2].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):13338
                                                                                                                                                                                                    Entropy (8bit):7.955914241534138
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:Sg2J9B3p1qbxR/ahUpKYAWsiz5qgIZq8ZcosHVp2bobexDOEnLrUfJGWzBmyoaRs:SVj3p1qbPCJ1agq8Fi9buDOEnkkcUyQZ
                                                                                                                                                                                                    MD5:8ABFE7BABC7F973CC7D5558FAD021247
                                                                                                                                                                                                    SHA1:E16A46AF8DF891B4541716B552B305C1FCF0D737
                                                                                                                                                                                                    SHA-256:A60D9070C0BD4107A6ABD798479E50AC3F465426035BAB90E246D6208391923E
                                                                                                                                                                                                    SHA-512:F1E8850CE6B2B924B66D51DB9C1C3552070AAEE73F3014C7BCB0E21C457B10FE2FA16FA6AFC0FD40A012A23C21B7326FCE42BF0648765678043649840D41F339
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...P.2.Y..W.....N*..Fq^.g...7.I.~Z........d9..........V...W...[.Xu...9.3Y.w.]?...F.z.p.G\,...4.R6Ku.7-R.......V.5WN..o.\Z..Jp..4.4.S.;.q...A<.b;..y:j........<Yx......k.~..........W...]...6...#....`..==k...8..y....'<(......./.u......+..5}KU.L.4@|......u?Z....h.f........Q.h.t.&.2..2...5....)..s.V...W.T..$En~c!..=j...-*+..Z.n..*.zz..Fq..r....%..dn.=*.h.i*..c.;M

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[3].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12481
                                                                                                                                                                                                    Entropy (8bit):7.95744118183733
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SVteeIYKwXoARhHAueGtrnPsEvdk3ocrcfJUHE8oboo9LDUpX3oOBPy/P/bfoa3:SeUKwXoArAueGVPbmP0ooxYXdByx3
                                                                                                                                                                                                    MD5:A2D3B4AFB2A002607DDCE350F77FC966
                                                                                                                                                                                                    SHA1:32D3943B5AF1F66318D4CDA42AD760693CC633A4
                                                                                                                                                                                                    SHA-256:8F4656C622F983AC0F545CAD4C97ECC6B57604FDE89267008966183924E7EC31
                                                                                                                                                                                                    SHA-512:72490C09568BD99F149EE116FBAA8A20DEFCA5D8C443586E2EAE397F2AEBD56A7BBC2C797EC936E0830181822DE5B698AF74C533C56621C47B395F19AFD004B3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(...(..HzR.]...........sR--.8.&ZBS..)...C.R...N).........D..K.V.)?...Zr..+..q..=.2u..;..;Sf?..W:.....K.T..h..3...z..6..L.._e.3.T.~j.....&0*.#`.mc%j9...%...J.8.6g.._.i.M........m.e.s..S.(.......A\x.....B.Ge.x.....vV. ....\v.0...9.V.w.$=k.d..{+3]...t..Z..Y)i.}s.W..2..g..MvB...C....a..q...W.4.2}y.f...%.a`.z._R"...$#v.Z.d...dz...zt...U.6.E.Q^..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[4].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):6937
                                                                                                                                                                                                    Entropy (8bit):7.918983413074886
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:SEz6a32x3Ij7X7McpyGOgFrppqYU9018tISfXNfHKUK6VrJC6KpvWY+65IJvKVmA:Sla329MYg/BUHfftKUKA86KpuV2Vl2y
                                                                                                                                                                                                    MD5:80167AEC837D448EF26CA00043E982A7
                                                                                                                                                                                                    SHA1:D8ADE465B8E0C3588A31ADD2EBA2B555F9C462DE
                                                                                                                                                                                                    SHA-256:A288A4E890603B9953D11F2748A64ADD1505CF8147EDA63554DA4ED24D5210AB
                                                                                                                                                                                                    SHA-512:B6C5F41EBBAEB3319A6CBEA3C6F24581A401C2ACDDFC75E5481B13C2DCC449955B359445A658A7EC6A775C81063E14851CFB2C36E499F2D4EE340B47227E4AD0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..F.....W.VVTp.}.w.\..j....."h..iZ#.jkq..q!.).fyG.....k.by..e].....u..S'.>.....>...MkRW.;....S.?...a....T....lTl..rH..*.R......:E....m$7M"..$&hv......'8=+=..U.^=..P.+.;zS0jW.....g..QA...H..R.4.G.2K#G......$.zrI..`.R..v..B...........v.9l....F.[..=....v..$...x.o... .Y....V.m.q.>l.s...MB.....$.`..j.s...hT.~j.`..=:Q5..%Y%A2....*......'...55...#(a......6..X........

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[5].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):15837
                                                                                                                                                                                                    Entropy (8bit):7.961425704044774
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SXE9KYNteblIYos0tGJf1D9Il8LY+TQ4a5J6WZXFAb:SXvYNteBo4ql8LY+s/LfZXU
                                                                                                                                                                                                    MD5:3DE2AB15BC51707C6912CBE8025BFDF2
                                                                                                                                                                                                    SHA1:D58D11F1A34944A7AB9DBE733A08A1DCCE090C9A
                                                                                                                                                                                                    SHA-256:229DD212C291FE95181213039D65D650F41E916DA34F38DEE961C68A76DFB9D0
                                                                                                                                                                                                    SHA-512:BAB5DD2608022953503A7E4CE2182DF254D2B3A45C2444E40100C0E5DBBF628108D80D51290DD35C65CD2DC4DB0FBA795FD05C3A837EEA30F908E81CA60D2D99
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..if&LU.n%EP.O.:..ns....*.X..Z.a 4#.9.).@;.E|-E.q.Z...8....ij.O.5...T<)...rz......b`.....jS.^Vn.......G......|.*..6.`.W....&..n..e[}>..\?...Q..{"..V...3.....Iu.,ou.....].rG.. ...+..n..|iy.b.m?Ii4..W.6L...}K8......_N|6...^...^n.>}..0...@.>..ay..+D...}+M{..c.$....a_.x.Y.~3|XM#Mq......1....v...............\/.t[.#y.}.h.h"R../._2.....w.?x./.....Y.o.^.X..]bQ..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[6].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):12239
                                                                                                                                                                                                    Entropy (8bit):7.956570294506286
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SPBl4U3rhbqHmfDuNaJAz8AQcnxELpxV31QA+RzYYhlWfNLLUsjLvOC:SPBCU3roEyNsi8A3Q31zIzYOlWlcsjz1
                                                                                                                                                                                                    MD5:2A11AA4AAF0717CFDBD063C2AE9DDE38
                                                                                                                                                                                                    SHA1:016510EA7F02603350F13EDA364CC02B7279020F
                                                                                                                                                                                                    SHA-256:1377F750621CB8B0D3B40415ACA20DEF13AE41747EF64795208CC61D5EAD5626
                                                                                                                                                                                                    SHA-512:D1C27D49CE4E0BE7B5CB505272D969A0D2AD0D06E798EC6F46292E3EEB026B8E60B3582F36171C8255431E68671BCC0A65F436FDCEAE547686FE81B7B96150FD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..>...Q..-..^n*Fi.1..&...,H.`...LV$.J...r..k....=.....k..Qr.."G....N.ZB,i...]...Ha.I....p.;rB..(I.6......J*..b.|3o.4@.7.H.V%....%9&.o....L.#.~5.\..+..H...q.EB..]....z..cQ>Z.5'.*...Q... 1N.;....`0.=i..R0.......)....+X.y.(..<..G.k."|i.<5..6..mB.c...X........{.M..J........$r.a.Y.._..i..s.8ld.t...i..Y...is8.P.y.;.\...RLm.K.Zr...]..d..|.].;g.q$g....U.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[7].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):22489
                                                                                                                                                                                                    Entropy (8bit):7.954708458456785
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:S7DEl6YxDygHmpoJSaXY+/d75cglp0d5jVIVaCYKp4Zw4Zz0zIX9pcmDb/JQAy:S7AsGzmeJSEV/YcKd5jVIVaCYKpz1lm4
                                                                                                                                                                                                    MD5:3CBABACD847E3C7F2378C183A231C725
                                                                                                                                                                                                    SHA1:B16BF35D17742965A6BCC4FE80D8F316B1A96B70
                                                                                                                                                                                                    SHA-256:A06336940DD3B2EE14539A4CBF21CCB2E97F6CB6FC6A8A0120DAA134EA80C3FC
                                                                                                                                                                                                    SHA-512:6795614B8377FA3C619B6D3488E86EDF47FA4797117B0B025EB64B291EA83E7E76DCD3514606BD32AF57EE4B8992745BF6A8B56A06F3D9FF9FA0B6EB9FE4F69E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..7M..-.....\.....Um...7-..)#.cSxf.k...j...9..}i..u..Tf6.I.FT.y......3..u'.....U..,....6...6~.O._W<.J.....m>..y."...~.[..=..#m.p.^.....-.........*.7;..e...5.Z_....v.v.Y"...DC`v.k...h....c..~k{GY...Z'.8H....)Z=.T.ZV..6'.|w...x.M^.s...."fU.....R...Y.Q.F.C..<3."..pG.O..,c.{'.{..O{!...K.I..k..+.q....]\<.g.....ic8..X.}9.V...VE\n...T..l.....h3..j.C.*.. g...*.o

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[8].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11914
                                                                                                                                                                                                    Entropy (8bit):7.959896746543477
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:SsIhaFsxyme4eEw841xDr/2NjxlOwfdpVOnHsdWKHdcQaZu1Rvo/nGLEFzqwrO1D:SiExe/vzDr/OxlvdpVYsYKHNaMQ/GLsu
                                                                                                                                                                                                    MD5:E026E4072F4255BD52C7D7B3A486A35C
                                                                                                                                                                                                    SHA1:71155E3AB67DF0E4A1FC4691018E38792A785FCF
                                                                                                                                                                                                    SHA-256:DED8D0F60D09ADF1DEDF0EE0C563B5AF95BC563282994B364B649B64AAE7B2A3
                                                                                                                                                                                                    SHA-512:F7A3989FD4FD5EEC683DFE93AF1427ED9D7CBCB60D75BF6A8B0552ABF8C5AD636ACFD3B27DCB4C769EC1CED9452388A0D5FED1B5F3FAA321457B55B6CE7DAA27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..\.Z2=j:P+..#..M...,1.....K@v...=....Jt..Y0I.4.u'..)?)5.>.......x.Y.gsE%bM..c.H..8.....6.....`f..,m...C....<.jmq$X...Eq..VTS;.[Fm=L...q....&M.c.....Gc.=.J...NMy..../5.!Kp+..';..!..x.q.Kn.b?..p;V?....N1..eGe.Y...h.'..R.n..s...<..I.8..#..M.f"I...t...VS.RB.FU..t.9....(...n8...O"'.p...Sjzn>.8..J..........hk..O_.g#........2|......C..eG.u...]9..-.4K..)$els...o..%

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\th[9].jpg

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                    Size (bytes):13657
                                                                                                                                                                                                    Entropy (8bit):7.9515218322530625
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:SvUgw6MhtL3GA9U0s870dqHYcbX+CZLcj8i2URabz:SvUS8kA9U0s8wd8YoX+yo12UAz
                                                                                                                                                                                                    MD5:262387AA891396B2F36D0C8DACAAC873
                                                                                                                                                                                                    SHA1:F63D8B687698F328D385637B137E389EF6E6EB18
                                                                                                                                                                                                    SHA-256:BF609976626C884E008A20DEB35D5D026FE2C0D14098DA1203F644F529B77DEB
                                                                                                                                                                                                    SHA-512:262CAB4A63490C3D92D10CEE236867B93C1C9FCAEF7B399D20B54633A406891086D66CA0A0217C8F2EC6600BE7F57ADB47114259FF9A5B1FB6B393A95F80ED0A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..2.?......C.3s...........x..z...J.h...te.{]G.....*9.K..z.Y..x.5..;..3....|A...o...c.+..s....#.-.4.^...#..~}*.G.P...kB.}..b.A..723.z2......q].c..IR..Q....3.......{T.^..].,.....uV...4..@..p....c.}./.Z....vzXHT..$S.N..\BLc...`,..3.\..X.W....{.\.. ..nSO....f...o.....$R......w...@..j.*..."6.....A.X_jw.gcm$.Hp......k.OS.7eFR[..H._C|%...y..I....]"8.*./..H9..#......s..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DEJP0E0O\vendors.79af82f3c5b028c7ea81[1].js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with very long lines (44421), with NEL line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):196564
                                                                                                                                                                                                    Entropy (8bit):5.416918453049597
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:5yggyMjcPJF7iol0cQtK7bKXZ7x7/3DwLqsop:5yggUJN3CE7cZ7MnQ
                                                                                                                                                                                                    MD5:87B6340D5C378650AB6B6DBFC2FCC200
                                                                                                                                                                                                    SHA1:42625DD447DD664F0078D831A020BED9A71A92A1
                                                                                                                                                                                                    SHA-256:27F89E7501CE8BF61E542F918284E6DDA03C31ADE11BD4B2174AE34D50EAABB3
                                                                                                                                                                                                    SHA-512:1BE5C0AD1109FF789A1D1A7D1145C1421E756A26D7350F512C0434DFF1422477EA36DA6BE886556CAD37B75ACA5942A10E6E71761A87263151419451487E5EE6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["vendors"],{29558:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},74322:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(String(t)+" is not a function");return t}},25135:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t)&&null!==t)throw TypeError("Can't set "+String(t)+" as a prototype");return t}},6664:function(t,e,r){var n=r(23362),o=r(35093),i=r(79549),a=n("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},99027:function(t,e,r){var n=r(58306).charAt;t.exports=function(t,e,r){return e+(r?n(t,e).length:1)}},57699:function(t){t.exports=function(t,e,r){if(!(t instanceof e))throw TypeError("Incorrect "+(r?r+" ":"")+"invocation");return t}},45150:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t))throw TypeError(String(t)+" is not an object");retur

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):49120
                                                                                                                                                                                                    Entropy (8bit):0.0017331682157558962
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Ztt:T
                                                                                                                                                                                                    MD5:0392ADA071EB68355BED625D8F9695F3
                                                                                                                                                                                                    SHA1:777253141235B6C6AC92E17E297A1482E82252CC
                                                                                                                                                                                                    SHA-256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
                                                                                                                                                                                                    SHA-512:EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\002c64ea-d076-4b31-897f-c7299bb70692.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:L:L
                                                                                                                                                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\2c32b913-bfc4-47bb-9ceb-91ed6ddb7d22.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 276634
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):242356
                                                                                                                                                                                                    Entropy (8bit):7.991210403664034
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:6144:nvRDe2ei//LiBCNBs4vIVeMRhzb6d0X7ayNC:nde2edcbveZRFW0X2yk
                                                                                                                                                                                                    MD5:B73A9C52EF76DD9F575BDCF919B05902
                                                                                                                                                                                                    SHA1:A7ED2E7B5F85D6E502B538FDEBD91343D811E55A
                                                                                                                                                                                                    SHA-256:EF05EE3FA07D46FDDD88DA7760509F7BA658D3A9A5696004404F5A128349B323
                                                                                                                                                                                                    SHA-512:01EB2E462F3EDE544A66C0EEABA9172B668B6EA20D2FEF5A3DD2217E60ED42F70523F194B8901A48CDA3E55E1F65A14BAB2FBE3B34D2CB410B1939B9BB7B4CBC
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:...........}.w..._..W.2...W.N&....I..k..'@..Y...c...~K..3vB....#.K.........R.Q.%.4......+.r.M?.\....l....q......Xo\..6.u..q.i.[V_...u..M0...LK......)KcyM.<#....q.$..n<..f5.'..V3oY.v.....k....f.kul...F..4.^..^.(r}.k..[...?.....Y..K.9.VZ..r.c.m..wL.n....L+7.fnY..j.r..v..;P..Xz....~..;....yO3.P.`.]H2u...]...zV....[..m...v;...6.....8.._.l...;NK..W.4...G.....4...>..F.xl.Z..B?.zAcZO.....VI.(}f..j.k..)._...z.72-h.Fj....o.WB..~.gO..5-da+PW....H..n......q......W..5.C.+m..u.~.<.....E.uf?.?...3.......$@+......Z..6..4...&..Mz..W..~...V-}@'.w....t..nx..,.....0b.:QR'..W|#2b.....3}....wP.5.n..j.&...8q-H#O4.{/..G.....%.@(.&...M.5X,3(.d.L3~[.Yp.^.m../4...OB..u .=.7...:.N.k.m......... T..6!8......._. ..?..<...v...X.F.....<,....01.+...H.'....<...E......O..%P..-HH[M.......1[.7@H....eBJw.|....x.....i.....i.&.B.A.L.l..T...6..z....4).Y.F.%.>.o.a6{vw.=..F....e..e|.i.4.n.O-.1.FK.Z+..x@..$...?..C.....t....>...O...n.mN{.R .@.uNG...p.TT......9#=.z.j.....Oa..S.a;.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\40a0e521-52f6-4353-a822-10a928ce80be.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:Google Chrome extension, version 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):98996
                                                                                                                                                                                                    Entropy (8bit):7.702003651641397
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                                                    MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                                                    SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                                                    SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                                                    SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\BIT5671.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):124775448
                                                                                                                                                                                                    Entropy (8bit):7.999996586829686
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                                    MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                                    SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                                    SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                                    SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):353
                                                                                                                                                                                                    Entropy (8bit):5.342297247785575
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:YEyxXfKQZz93TL56s/uwxfkvs14U0QJjDrwv/uwxtky56s/C:YjxPx93TL56s/V8RZ0Dkv/VWy56s/C
                                                                                                                                                                                                    MD5:175CAE7EADDC567FFB1DEA5D38F000E6
                                                                                                                                                                                                    SHA1:91256E14531320039CEB2AEAD324B332AD53A7A4
                                                                                                                                                                                                    SHA-256:FCA1E4D2C739329B19A5BFF5EBDD1A9517AC88FA5A154E05AF0009B99E3C7FC1
                                                                                                                                                                                                    SHA-512:E0601465A839645B9D13C86877A4808AC14F9148E055CE4D6CFE8D6408D2EFA285105DDECB692161883A4FE2F0E16A5D435814EC0BAA6F30D6BD8BC50372D5C5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"logTime": "0314/082545", "correlationVector":"MxP0ouLXpV9/56bRuISFTR","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0314/082547", "correlationVector":"7B05E5A6AA024821A252F5E28A911E4E","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0314/082547", "correlationVector":"j3HUVpNPc7Z+5JL+ASAm1u","action":"EXTENSION_UPDATER", "result":""}.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\dc7e83bf-d253-45c9-9e97-07f7bbda7ec8.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:L:L
                                                                                                                                                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\eb17a859-2a34-4157-8089-7d9ad062c46b.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:Google Chrome extension, version 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11185
                                                                                                                                                                                                    Entropy (8bit):7.951995436832936
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                                                    MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                                                    SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                                                    SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                                                    SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\40a0e521-52f6-4353-a822-10a928ce80be.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:Google Chrome extension, version 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):98996
                                                                                                                                                                                                    Entropy (8bit):7.702003651641397
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                                                    MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                                                    SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                                                    SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                                                    SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\128.png

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4982
                                                                                                                                                                                                    Entropy (8bit):7.929761711048726
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                                                                                                                                                                    MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                                                                                                                                                                    SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                                                                                                                                                                    SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                                                                                                                                                                    SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\af\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):908
                                                                                                                                                                                                    Entropy (8bit):4.512512697156616
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                                                                                                                                                                    MD5:12403EBCCE3AE8287A9E823C0256D205
                                                                                                                                                                                                    SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                                                                                                                                                                    SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                                                                                                                                                                    SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\am\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1285
                                                                                                                                                                                                    Entropy (8bit):4.702209356847184
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                                                                                                                                                                    MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                                                                                                                                                                    SHA1:58979859B28513608626B563138097DC19236F1F
                                                                                                                                                                                                    SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                                                                                                                                                                    SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ar\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1244
                                                                                                                                                                                                    Entropy (8bit):4.5533961615623735
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                                                                                                                                                                    MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                                                                                                                                                                    SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                                                                                                                                                                    SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                                                                                                                                                                    SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\az\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):977
                                                                                                                                                                                                    Entropy (8bit):4.867640976960053
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                                                                                                                                                                    MD5:9A798FD298008074E59ECC253E2F2933
                                                                                                                                                                                                    SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                                                                                                                                                                    SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                                                                                                                                                                    SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\be\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3107
                                                                                                                                                                                                    Entropy (8bit):3.535189746470889
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                                                                                                                                                                    MD5:68884DFDA320B85F9FC5244C2DD00568
                                                                                                                                                                                                    SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                                                                                                                                                                    SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                                                                                                                                                                    SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\bg\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1389
                                                                                                                                                                                                    Entropy (8bit):4.561317517930672
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                                                                                                                                                                    MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                                                                                                                                                                    SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                                                                                                                                                                    SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                                                                                                                                                                    SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\bn\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1763
                                                                                                                                                                                                    Entropy (8bit):4.25392954144533
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                                                                                                                                                                    MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                                                                                                                                                                    SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                                                                                                                                                                    SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                                                                                                                                                                    SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ca\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):930
                                                                                                                                                                                                    Entropy (8bit):4.569672473374877
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                                                                                                                                                                    MD5:D177261FFE5F8AB4B3796D26835F8331
                                                                                                                                                                                                    SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                                                                                                                                                                    SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                                                                                                                                                                    SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\cs\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):913
                                                                                                                                                                                                    Entropy (8bit):4.947221919047
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                                                                                                                                                                    MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                                                                                                                                                                    SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                                                                                                                                                                    SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                                                                                                                                                                    SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\cy\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):806
                                                                                                                                                                                                    Entropy (8bit):4.815663786215102
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                                                                                                                                                                    MD5:A86407C6F20818972B80B9384ACFBBED
                                                                                                                                                                                                    SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                                                                                                                                                                    SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                                                                                                                                                                    SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\da\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):883
                                                                                                                                                                                                    Entropy (8bit):4.5096240460083905
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                                                                                                                                                                    MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                                                                                                                                                                    SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                                                                                                                                                                    SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                                                                                                                                                                    SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\de\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1031
                                                                                                                                                                                                    Entropy (8bit):4.621865814402898
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                                                                                                                                                                    MD5:D116453277CC860D196887CEC6432FFE
                                                                                                                                                                                                    SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                                                                                                                                                                    SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                                                                                                                                                                    SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\el\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1613
                                                                                                                                                                                                    Entropy (8bit):4.618182455684241
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                                                                                                                                                                    MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                                                                                                                                                                    SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                                                                                                                                                                    SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                                                                                                                                                                    SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\en\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):851
                                                                                                                                                                                                    Entropy (8bit):4.4858053753176526
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                                                                                                                                    MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                                                                                                                                    SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                                                                                                                                    SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                                                                                                                                    SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\en_CA\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):851
                                                                                                                                                                                                    Entropy (8bit):4.4858053753176526
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                                                                                                                                    MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                                                                                                                                    SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                                                                                                                                    SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                                                                                                                                    SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\en_GB\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):848
                                                                                                                                                                                                    Entropy (8bit):4.494568170878587
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                                                                                                                                                                    MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                                                                                                                                                                    SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                                                                                                                                                                    SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                                                                                                                                                                    SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\en_US\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1425
                                                                                                                                                                                                    Entropy (8bit):4.461560329690825
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                                                                                                                                                                    MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                                                                                                                                                                    SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                                                                                                                                                                    SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                                                                                                                                                                    SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\es\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):961
                                                                                                                                                                                                    Entropy (8bit):4.537633413451255
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                                                                                                                                                                    MD5:F61916A206AC0E971CDCB63B29E580E3
                                                                                                                                                                                                    SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                                                                                                                                                                    SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                                                                                                                                                                    SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\es_419\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):959
                                                                                                                                                                                                    Entropy (8bit):4.570019855018913
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                                                                                                                                                                    MD5:535331F8FB98894877811B14994FEA9D
                                                                                                                                                                                                    SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                                                                                                                                                                    SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                                                                                                                                                                    SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\et\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):968
                                                                                                                                                                                                    Entropy (8bit):4.633956349931516
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                                                                                                                                                                    MD5:64204786E7A7C1ED9C241F1C59B81007
                                                                                                                                                                                                    SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                                                                                                                                                                    SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                                                                                                                                                                    SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\eu\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):838
                                                                                                                                                                                                    Entropy (8bit):4.4975520913636595
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                                                                                                                                                                    MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                                                                                                                                                                    SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                                                                                                                                                                    SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                                                                                                                                                                    SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\fa\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1305
                                                                                                                                                                                                    Entropy (8bit):4.673517697192589
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                                                                                                                                                                    MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                                                                                                                                                                    SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                                                                                                                                                                    SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                                                                                                                                                                    SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\fi\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):911
                                                                                                                                                                                                    Entropy (8bit):4.6294343834070935
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                                                                                                                                                                    MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                                                                                                                                                                    SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                                                                                                                                                                    SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                                                                                                                                                                    SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\fil\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):939
                                                                                                                                                                                                    Entropy (8bit):4.451724169062555
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                                                                                                                                                                    MD5:FCEA43D62605860FFF41BE26BAD80169
                                                                                                                                                                                                    SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                                                                                                                                                                    SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                                                                                                                                                                    SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\fr\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):977
                                                                                                                                                                                                    Entropy (8bit):4.622066056638277
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                                                                                                                                                                    MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                                                                                                                                                                    SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                                                                                                                                                                    SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                                                                                                                                                                    SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\fr_CA\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):972
                                                                                                                                                                                                    Entropy (8bit):4.621319511196614
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                                                                                                                                                                    MD5:6CAC04BDCC09034981B4AB567B00C296
                                                                                                                                                                                                    SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                                                                                                                                                                    SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                                                                                                                                                                    SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\gl\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):990
                                                                                                                                                                                                    Entropy (8bit):4.497202347098541
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                                                                                                                                                                    MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                                                                                                                                                                    SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                                                                                                                                                                    SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                                                                                                                                                                    SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\gu\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1658
                                                                                                                                                                                                    Entropy (8bit):4.294833932445159
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                                                                                                                                                                    MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                                                                                                                                                                    SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                                                                                                                                                                    SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                                                                                                                                                                    SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\hi\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1672
                                                                                                                                                                                                    Entropy (8bit):4.314484457325167
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                                                                                                                                                                    MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                                                                                                                                                                    SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                                                                                                                                                                    SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                                                                                                                                                                    SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\hr\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):935
                                                                                                                                                                                                    Entropy (8bit):4.6369398601609735
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                                                                                                                                                                    MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                                                                                                                                                                    SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                                                                                                                                                                    SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                                                                                                                                                                    SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\hu\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1065
                                                                                                                                                                                                    Entropy (8bit):4.816501737523951
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                                                                                                                                                                    MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                                                                                                                                                                    SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                                                                                                                                                                    SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                                                                                                                                                                    SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\hy\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2771
                                                                                                                                                                                                    Entropy (8bit):3.7629875118570055
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                                                                                                                                                                    MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                                                                                                                                                                    SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                                                                                                                                                                    SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                                                                                                                                                                    SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\id\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):858
                                                                                                                                                                                                    Entropy (8bit):4.474411340525479
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                                                                                                                                                                    MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                                                                                                                                                                    SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                                                                                                                                                                    SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                                                                                                                                                                    SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\is\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):954
                                                                                                                                                                                                    Entropy (8bit):4.631887382471946
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
                                                                                                                                                                                                    MD5:1F565FB1C549B18AF8BBFED8DECD5D94
                                                                                                                                                                                                    SHA1:B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
                                                                                                                                                                                                    SHA-256:E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
                                                                                                                                                                                                    SHA-512:A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\it\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):899
                                                                                                                                                                                                    Entropy (8bit):4.474743599345443
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                                                                                                                                                                    MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                                                                                                                                                                    SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                                                                                                                                                                    SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                                                                                                                                                                    SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\iw\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2230
                                                                                                                                                                                                    Entropy (8bit):3.8239097369647634
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                                                                                                                                                                    MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                                                                                                                                                                    SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                                                                                                                                                                    SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                                                                                                                                                                    SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ja\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1160
                                                                                                                                                                                                    Entropy (8bit):5.292894989863142
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                                                                                                                                                                    MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                                                                                                                                                                    SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                                                                                                                                                                    SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                                                                                                                                                                    SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ka\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3264
                                                                                                                                                                                                    Entropy (8bit):3.586016059431306
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                                                                                                                                                                    MD5:83F81D30913DC4344573D7A58BD20D85
                                                                                                                                                                                                    SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                                                                                                                                                                    SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                                                                                                                                                                    SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\kk\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3235
                                                                                                                                                                                                    Entropy (8bit):3.6081439490236464
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                                                                                                                                                                    MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                                                                                                                                                                    SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                                                                                                                                                                    SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                                                                                                                                                                    SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\km\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3122
                                                                                                                                                                                                    Entropy (8bit):3.891443295908904
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                                                                                                                                                                    MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                                                                                                                                                                    SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                                                                                                                                                                    SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                                                                                                                                                                    SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\kn\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1880
                                                                                                                                                                                                    Entropy (8bit):4.295185867329351
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
                                                                                                                                                                                                    MD5:8E16966E815C3C274EEB8492B1EA6648
                                                                                                                                                                                                    SHA1:7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
                                                                                                                                                                                                    SHA-256:418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
                                                                                                                                                                                                    SHA-512:85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ko\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1042
                                                                                                                                                                                                    Entropy (8bit):5.3945675025513955
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                                                                                                                                                                    MD5:F3E59EEEB007144EA26306C20E04C292
                                                                                                                                                                                                    SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                                                                                                                                                                    SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                                                                                                                                                                    SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\lo\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2535
                                                                                                                                                                                                    Entropy (8bit):3.8479764584971368
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                                                                                                                                                                    MD5:E20D6C27840B406555E2F5091B118FC5
                                                                                                                                                                                                    SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                                                                                                                                                                    SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                                                                                                                                                                    SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\lt\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1028
                                                                                                                                                                                                    Entropy (8bit):4.797571191712988
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                                                                                                                                                                    MD5:970544AB4622701FFDF66DC556847652
                                                                                                                                                                                                    SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                                                                                                                                                                    SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                                                                                                                                                                    SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\lv\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):994
                                                                                                                                                                                                    Entropy (8bit):4.700308832360794
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                                                                                                                                                                    MD5:A568A58817375590007D1B8ABCAEBF82
                                                                                                                                                                                                    SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                                                                                                                                                                    SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                                                                                                                                                                    SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ml\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2091
                                                                                                                                                                                                    Entropy (8bit):4.358252286391144
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                                                                                                                                                                    MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                                                                                                                                                                    SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                                                                                                                                                                    SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                                                                                                                                                                    SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\mn\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2778
                                                                                                                                                                                                    Entropy (8bit):3.595196082412897
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                                                                                                                                                                    MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                                                                                                                                                                    SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                                                                                                                                                                    SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                                                                                                                                                                    SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\mr\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1719
                                                                                                                                                                                                    Entropy (8bit):4.287702203591075
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                                                                                                                                                                    MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                                                                                                                                                                    SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                                                                                                                                                                    SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                                                                                                                                                                    SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ms\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):936
                                                                                                                                                                                                    Entropy (8bit):4.457879437756106
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                                                                                                                                                                    MD5:7D273824B1E22426C033FF5D8D7162B7
                                                                                                                                                                                                    SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                                                                                                                                                                    SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                                                                                                                                                                    SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\my\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3830
                                                                                                                                                                                                    Entropy (8bit):3.5483353063347587
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                                                                                                                                                                    MD5:342335A22F1886B8BC92008597326B24
                                                                                                                                                                                                    SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                                                                                                                                                                    SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                                                                                                                                                                    SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ne\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1898
                                                                                                                                                                                                    Entropy (8bit):4.187050294267571
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                                                                                                                                                                    MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                                                                                                                                                                    SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                                                                                                                                                                    SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                                                                                                                                                                    SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\nl\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):914
                                                                                                                                                                                                    Entropy (8bit):4.513485418448461
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                                                                                                                                                                    MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                                                                                                                                                                    SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                                                                                                                                                                    SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                                                                                                                                                                    SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\no\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):878
                                                                                                                                                                                                    Entropy (8bit):4.4541485835627475
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                                                                                                                                                                    MD5:A1744B0F53CCF889955B95108367F9C8
                                                                                                                                                                                                    SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                                                                                                                                                                    SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                                                                                                                                                                    SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\pa\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2766
                                                                                                                                                                                                    Entropy (8bit):3.839730779948262
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                                                                                                                                                                    MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                                                                                                                                                                    SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                                                                                                                                                                    SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                                                                                                                                                                    SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\pl\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):978
                                                                                                                                                                                                    Entropy (8bit):4.879137540019932
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                                                                                                                                                                    MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                                                                                                                                                                    SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                                                                                                                                                                    SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                                                                                                                                                                    SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\pt_BR\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):907
                                                                                                                                                                                                    Entropy (8bit):4.599411354657937
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                                                                                                                                                                    MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                                                                                                                                                                    SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                                                                                                                                                                    SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                                                                                                                                                                    SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\pt_PT\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):914
                                                                                                                                                                                                    Entropy (8bit):4.604761241355716
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                                                                                                                                                                    MD5:0963F2F3641A62A78B02825F6FA3941C
                                                                                                                                                                                                    SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                                                                                                                                                                    SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                                                                                                                                                                    SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ro\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):937
                                                                                                                                                                                                    Entropy (8bit):4.686555713975264
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                                                                                                                                                                    MD5:BED8332AB788098D276B448EC2B33351
                                                                                                                                                                                                    SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                                                                                                                                                                    SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                                                                                                                                                                    SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ru\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1337
                                                                                                                                                                                                    Entropy (8bit):4.69531415794894
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                                                                                                                                                                    MD5:51D34FE303D0C90EE409A2397FCA437D
                                                                                                                                                                                                    SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                                                                                                                                                                    SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                                                                                                                                                                    SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\si\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2846
                                                                                                                                                                                                    Entropy (8bit):3.7416822879702547
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                                                                                                                                                                    MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                                                                                                                                                                    SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                                                                                                                                                                    SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                                                                                                                                                                    SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\sk\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):934
                                                                                                                                                                                                    Entropy (8bit):4.882122893545996
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                                                                                                                                                                    MD5:8E55817BF7A87052F11FE554A61C52D5
                                                                                                                                                                                                    SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                                                                                                                                                                    SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                                                                                                                                                                    SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\sl\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):963
                                                                                                                                                                                                    Entropy (8bit):4.6041913416245
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                                                                                                                                                                    MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                                                                                                                                                                    SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                                                                                                                                                                    SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                                                                                                                                                                    SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\sr\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1320
                                                                                                                                                                                                    Entropy (8bit):4.569671329405572
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                                                                                                                                                                    MD5:7F5F8933D2D078618496C67526A2B066
                                                                                                                                                                                                    SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                                                                                                                                                                    SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                                                                                                                                                                    SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\sv\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):884
                                                                                                                                                                                                    Entropy (8bit):4.627108704340797
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                                                                                                                                                                    MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                                                                                                                                                                    SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                                                                                                                                                                    SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                                                                                                                                                                    SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\sw\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):980
                                                                                                                                                                                                    Entropy (8bit):4.50673686618174
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                                                                                                                                                                    MD5:D0579209686889E079D87C23817EDDD5
                                                                                                                                                                                                    SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                                                                                                                                                                    SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                                                                                                                                                                    SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ta\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1941
                                                                                                                                                                                                    Entropy (8bit):4.132139619026436
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                                                                                                                                                                    MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                                                                                                                                                                    SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                                                                                                                                                                    SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                                                                                                                                                                    SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\te\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1969
                                                                                                                                                                                                    Entropy (8bit):4.327258153043599
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                                                                                                                                                                    MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                                                                                                                                                                    SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                                                                                                                                                                    SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                                                                                                                                                                    SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\th\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1674
                                                                                                                                                                                                    Entropy (8bit):4.343724179386811
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                                                                                                                                                                    MD5:64077E3D186E585A8BEA86FF415AA19D
                                                                                                                                                                                                    SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                                                                                                                                                                    SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                                                                                                                                                                    SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\tr\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1063
                                                                                                                                                                                                    Entropy (8bit):4.853399816115876
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                                                                                                                                                                    MD5:76B59AAACC7B469792694CF3855D3F4C
                                                                                                                                                                                                    SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                                                                                                                                                                    SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                                                                                                                                                                    SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\uk\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1333
                                                                                                                                                                                                    Entropy (8bit):4.686760246306605
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                                                                                                                                                                    MD5:970963C25C2CEF16BB6F60952E103105
                                                                                                                                                                                                    SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                                                                                                                                                                    SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                                                                                                                                                                    SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\ur\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1263
                                                                                                                                                                                                    Entropy (8bit):4.861856182762435
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                                                                                                                                                                    MD5:8B4DF6A9281333341C939C244DDB7648
                                                                                                                                                                                                    SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                                                                                                                                                                    SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                                                                                                                                                                    SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\vi\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1074
                                                                                                                                                                                                    Entropy (8bit):5.062722522759407
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                                                                                                                                                                    MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                                                                                                                                                                    SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                                                                                                                                                                    SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                                                                                                                                                                    SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\zh_CN\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):879
                                                                                                                                                                                                    Entropy (8bit):5.7905809868505544
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                                                                                                                                                                    MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                                                                                                                                                                    SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                                                                                                                                                                    SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                                                                                                                                                                    SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\zh_HK\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1205
                                                                                                                                                                                                    Entropy (8bit):4.50367724745418
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                                                                                                                                                                    MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                                                                                                                                                                    SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                                                                                                                                                                    SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                                                                                                                                                                    SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\zh_TW\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):843
                                                                                                                                                                                                    Entropy (8bit):5.76581227215314
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                                                                                                                                                                    MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                                                                                                                                                                    SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                                                                                                                                                                    SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                                                                                                                                                                    SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_locales\zu\messages.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):912
                                                                                                                                                                                                    Entropy (8bit):4.65963951143349
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                                                                                                                                                                    MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                                                                                                                                                                    SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                                                                                                                                                                    SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                                                                                                                                                                    SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\_metadata\verified_contents.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):18518
                                                                                                                                                                                                    Entropy (8bit):5.709939179890619
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:cLjrY6QDAwrlbs3jiD1DisLSFqwAqmq9ayzDy:2jrSHbMjidLSFxA+ayfy
                                                                                                                                                                                                    MD5:05BEDDE10A35815204BEB8BADD3DB9B4
                                                                                                                                                                                                    SHA1:000E7E6984EDEF11E937929DB047FF6FCB87CB1E
                                                                                                                                                                                                    SHA-256:65A138E44834C8EE9D2946960C97D6FF3978874F4641A16568322B9318976151
                                                                                                                                                                                                    SHA-512:9F42514DBA8F11ED41041C68960B7538BADFC0CEC6AF01F885AB7197DA27CAE0EC0DE78E49D585612AC4B5C025C070EF4F03ED39E894D9699FFE887272487D07
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiOE1xa2JXMkFQWkVpbzlQTHlYNVItT3o1bGs5a29sbnlWTWtvYlVabk15YyIsInBhdGgiOiJfbG9jYWxlcy9hZi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoicWhJZ1d4Q0hVTS1mb0plRVlhYllpQjVPZ05vZ3FFYllKTnBBYWRuSkdFYyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiV0E0cW96b3R5ZzJrcUpKU0FEYWNVMGNDbEdJYjlmMmp1ejhYalh0YUhybyIsInBhdGgiOiJfbG9jYWxlcy9hbS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiWk9BYndwSzZMcUZwbFhiOHhFVTJjRWRTRHVpVjRwRE03aURDVEpNMjJPOCJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiQlk4QVRlUUktWHNqLWFSbVZfTi03dHVzUlJyQUNkU25yU3NhT2d3R3pTWSIsInBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiX0pLU3pRcGk4TVczZE5WZldwN281STVjX09

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\dasherSettingSchema.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):854
                                                                                                                                                                                                    Entropy (8bit):4.284628987131403
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                                                                                                                                                                    MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                                                                                                                                                                    SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                                                                                                                                                                    SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                                                                                                                                                                    SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\eventpage_bin_prod.js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text, with very long lines (3422)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):82471
                                                                                                                                                                                                    Entropy (8bit):5.379624543852408
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:1jejtmkYJ6fA5z4d+3+NOzChedbeZtk68cWcYuCKRLlGGwL:BvuTczCQbIZBY7L
                                                                                                                                                                                                    MD5:A7D0D56DF8E576C9CDE7DB6C11045CD7
                                                                                                                                                                                                    SHA1:EAFE0A7FE5217B254FCE57223A5C8F4A30B1B56A
                                                                                                                                                                                                    SHA-256:37FABD0B7AB065ECAF481064D770A2DBF61A8C23F6BE1E10D2085812ADB0EC8A
                                                                                                                                                                                                    SHA-512:66ACA2AA2BC4DB901250DA2DAD0202352D89CD8C1A16616F106FF73D0EED2E1EC4852940443BAFDFAAB264AF1185769B33E240BB94E8B263AA5B0D6AF16CFB10
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Preview:'use strict';function m(){return function(){}}var p;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ca(this);function t(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g){this.g=f;ba(this,"description",{configurable:!

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\manifest.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):2397
                                                                                                                                                                                                    Entropy (8bit):5.424093225335539
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1HEZ4qW4VlELb/KxktGu7VwELb/s2QDkUpvdlmF1exy/Otj1pSVvs:W7WsaLTKQGuxTLT2Rv3mves/OPpSVk
                                                                                                                                                                                                    MD5:A71CE16FE7E71948777A01794E461DE4
                                                                                                                                                                                                    SHA1:51310DF56DBDEC1329DB8946888A208B477712CA
                                                                                                                                                                                                    SHA-256:431EBF00F6BAB228FBAD80663CAAE73427516D6AB3D34939ECB6DCB5D0A566CC
                                                                                                                                                                                                    SHA-512:EAA2513BCA54F184083CD6E50738EF99D8C5C562075D5237E5B5A23DDA8DA694A7B0F0E9251C7C9A3BE2BD51614CCEBF32127F4CC9C49DDA9A7036434E7D5AAB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "persistent": false,.. "scripts": [ "eventpage_bin_prod.js" ].. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": "script-src 'self'; object-src 'self'",.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "matches": [ "htt

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_309492163\CRX_INSTALL\page_embed_script.js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):291
                                                                                                                                                                                                    Entropy (8bit):4.644891151983713
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK6M23:2Q8KVqb2u/Rt3OnjI
                                                                                                                                                                                                    MD5:EE9839F99DED6F38DC561DB846B51E80
                                                                                                                                                                                                    SHA1:DD2128A473C2FF47471400C81EFF416285DE606E
                                                                                                                                                                                                    SHA-256:06E08E421EB7F0FE7959D68E27D40A9146A54503090D95CFAC6F2FFD72A78769
                                                                                                                                                                                                    SHA-512:C8D77607F00CB8012CD056CE61CB77918EC43621270511303E09577F89CC57D4954E22E2C8C3FB1029AAE29F8142DAAE2E938CD5590AD0E5DE6DB1208AFEF874
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=2;}).call(this);.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_689802529\CRX_INSTALL\_metadata\verified_contents.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1753
                                                                                                                                                                                                    Entropy (8bit):5.8889033066924155
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                                                                                                                                                                    MD5:738E757B92939B24CDBBD0EFC2601315
                                                                                                                                                                                                    SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                                                                                                                                                                    SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                                                                                                                                                                    SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_689802529\CRX_INSTALL\content.js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):9815
                                                                                                                                                                                                    Entropy (8bit):6.1716321262973315
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                                                                                                                                                                    MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                                                                                                                                                                    SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                                                                                                                                                                    SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                                                                                                                                                                    SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_689802529\CRX_INSTALL\content_new.js

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):10388
                                                                                                                                                                                                    Entropy (8bit):6.174387413738973
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                                                                                                                                                                    MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                                                                                                                                                                    SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                                                                                                                                                                    SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                                                                                                                                                                    SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                    Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_689802529\CRX_INSTALL\manifest.json

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):962
                                                                                                                                                                                                    Entropy (8bit):5.698567446030411
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                                                                                                                                                                    MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                                                                                                                                                                    SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                                                                                                                                                                    SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                                                                                                                                                                    SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\scoped_dir7648_689802529\eb17a859-2a34-4157-8089-7d9ad062c46b.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    File Type:Google Chrome extension, version 3
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11185
                                                                                                                                                                                                    Entropy (8bit):7.951995436832936
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                                                    MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                                                    SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                                                    SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                                                    SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{21DA6F9B-FFAF-40CA-B20A-685EF0F3A5DF}-brave_installer-x64.exe (copy)

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):124775448
                                                                                                                                                                                                    Entropy (8bit):7.999996586829686
                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                    SSDEEP:3145728:G7pzQwa6D75W9AobFmNOlpCbLcRLq4vtpN8/RKA/gSBa5:GdzjD7s9FlgsRL9Vo/u5
                                                                                                                                                                                                    MD5:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                                    SHA1:FAA553B01EE47E9079F24A930BCE454BC2D48B37
                                                                                                                                                                                                    SHA-256:F5E6C9BA8FB7867D041BC5D7591B50714688FBD31E6716A4D631D549ECEEB03C
                                                                                                                                                                                                    SHA-512:4B178177039B894A92E712BFBE7358BB84F2830E8E042B77B3C1864A449F48FAADE7F5F016BC9C03B946BB47AF8389A3DE62C8CC283B9A948021E04338BEBDD6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...(..e.........."......8....o................@............................. p.......p...`..................................................Y..P........go...........o..(....p.(....X..............................PP..@...........0\...............................text...67.......8.................. ..`.rdata..`....P.......<..............@..@.data...p....p.......R..............@....pdata...............T..............@..@.retplne.............X...................rsrc....go......ho..Z..............@..@.reloc..(.....p.......o.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\~DF51CA27151F2938E5.TMP

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):0.1622069154094361
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:ClwTQlBwkU5i+wlywSQ/uow+ylRLf7D4AxJ3t:COQTFU5itRC9Vd
                                                                                                                                                                                                    MD5:6FC8A48263D8EAC96FBF827FC27A4636
                                                                                                                                                                                                    SHA1:174B2B909555EBCD886D72A6270952D63E697007
                                                                                                                                                                                                    SHA-256:537D0BD40935B0F64F14689AEDE682A8CF95C4F3100843593F7C49B6FF96A008
                                                                                                                                                                                                    SHA-512:3A63517A81C8BC8A01C240DB28C7FAA7FF5DF1C0448D84E546E733DC48D8F6007C846EC44BCCF085AA0226698DA61898996DAAF30D79135AA3FACCF52C2FDBA1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\~DF576EA7BC8D9C81C4.TMP

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):1.1826227335252808
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:9SgKS9LYu09mAkgBgdoHgJd9HgfdoIn4BuPTvO2k79RNLSOd9ZN+N8/V/GS9iHMT:ls9ruBu7vyNLLN+N8/VeoFBiSLZLD
                                                                                                                                                                                                    MD5:363CAD2CBB57E3690E8862126AA0D1D1
                                                                                                                                                                                                    SHA1:5CD6BC318BB475509AD0BEE70BAADFB829B363C1
                                                                                                                                                                                                    SHA-256:6BF4DAD5EF70247FBFB3BBF85D07EE40FC94DCA36B8B60BAABA022A343AB9DBA
                                                                                                                                                                                                    SHA-512:743E07482D915DC22C8FC517CCC744A41DA24763B20DF488A2822712ED43471D27E19A08CEAF769D8A0223DE50ADF1EA6B671296F569DC6B9A31C5F261142D7F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\~DF9EC10914984FE20F.TMP

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):0.2364979660455589
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                                                                                                                                    MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                                                                                                                                    SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                                                                                                                                    SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                                                                                                                                    SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\~DFE032F33512B6866F.TMP

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):1.723755831068427
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:48:9SgKS9LYu09HKWiDcrTyAlZjkDuDD0hsDuDaTqkAKfC7ZXPYjIr2mAVgA6yrTzwD:ls9HTlZLDD0BDEdf6PYjISm2gry7Q
                                                                                                                                                                                                    MD5:6FB97A49D409795240F059B93F71548E
                                                                                                                                                                                                    SHA1:4D727CA2CB6369D502F9F1D26E7C1753780DC741
                                                                                                                                                                                                    SHA-256:06A6D21B908AD53AAF8A5F955F122E2D4B38241B8C2688BC86B41F1C6A91AAD0
                                                                                                                                                                                                    SHA-512:59ABB107AD0C6D4628D9A4B719751FE6B30EFA419779B7B600CB49BD88B3C947512DBF296DF1435862DC474B47A6B28F6456443190090FF9341B58019D46BF23
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\~DFEF960749AAFE4FCD.TMP

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):0.2838733134131672
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1CCF4t:9vqyVKvqy6yEyvy5DlsNUAcVK
                                                                                                                                                                                                    MD5:7B259CF766FA22CEF34695F251573965
                                                                                                                                                                                                    SHA1:00BBD1DAAEF8C25DF71818CF110A8FF3E962F976
                                                                                                                                                                                                    SHA-256:2BBB152583A323AFBCAEF7D768F21928DD7C7F82A7D9297F4BE97575ED793321
                                                                                                                                                                                                    SHA-512:B9B83E9F9062FAF6F0CD1B500412BE8710C3DCD9440DB824B6898D4B684C6BE4AAA63525ECE0E99CB748C5DED0EEE9A94E083538B1114DB6C1D5D88DC251858B
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\~DFF8A2C987D8847B2E.TMP

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                    Entropy (8bit):0.2364979660455589
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN2cgJ8H1C:9vqyVKvqy6yEyvy5DlsN5Ac
                                                                                                                                                                                                    MD5:7DA63F3349ADCE46708E4C0690063EC5
                                                                                                                                                                                                    SHA1:3A4B1BC2A9F48A8E4227E461B85B46F14CA69D3D
                                                                                                                                                                                                    SHA-256:C40819535B4185A8DB93B768A6B27657C5234D9789992D278CC01A4B3E353775
                                                                                                                                                                                                    SHA-512:20C16F35AFA9B663C268224BE0AC6CFCAD7F5EDD2F3903E50BA5803ECC421BF54ED974001D3F056CA8E830832C874BA53AD30B111000ECBA361B9DF18BE2265F
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):55
                                                                                                                                                                                                    Entropy (8bit):4.306461250274409
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                                    MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                                    SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                                    SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                                    SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                                    C:\Windows\Temp\guiCA69.tmp

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (4404), with no line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4407
                                                                                                                                                                                                    Entropy (8bit):6.01624901027111
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:7wcN5LCsQ3+qLjHt1bMCmC8YMcwAqi+FY2pZqiUkWIk0AwWAJGOE1:J6+qXHt1QCmUMcwTiWY2hUkyrwWAc
                                                                                                                                                                                                    MD5:DA89A2F9314528D7D6A27CC4DF5965E4
                                                                                                                                                                                                    SHA1:3242EE1187E7ECF79ABC052ED6725FC070E6423C
                                                                                                                                                                                                    SHA-256:CFF0E6414634580AF01999F04356F14285CD48BC004D741DE6615B93E20EC4F0
                                                                                                                                                                                                    SHA-512:B6584795A15D3EF45BC1EDC0DE4E59633A7FF6C26CB481D580FC1C023CF9474BE8B1CFACD553CE26106AC868A5E058204C8AB979999AE52EF6E5317479F5DEA1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.{"variations_compressed_seed":"H4sICCrd72UAA3NlZWQAzVrbb9vWGbeUpnWPc3Ho+BLHSeSkSV0lEkjqvqIoZMnXWrZKyUkwDFAp8lhiTJEqSclRwXVbh2F92EvRPQ/Duu0/6Nv+gGF/wl6Gve3P2Hd4kQ4pyZ6Bri2SSBT53fhdfuc73wmK5SUp1SxkODktZsUT+JZw7oSVM1wacyeFdJb5YwQtlfGJ2FMtrrup6tKporVqVk8e5CP7z9BbW5rYVLE8P9N8gO5tGmIfF+UmIRtj2k+g2bJiuuRy8wFzAfkcesu7OT8jrDCowCe5ZIpNZnKxmVh0Y2YjshHdeOOTCPMc3fEIHYElvdMRNdn0jVwbGSk3b6LrAaKgFjSSDHIV9IiWe9TRlKb+uqIbeFcxLd0Y+BrepTWsohXvMaGsYdGQ2gI2QUpI2WxsZqjqGN12dGxjLB93ZdHCvuyHtOxFtOCQHeIzc0QaFntlKPavERRzGHZ0vaXimtLS9rQqNjqKaSq65uuI0zruobvnsOw/pYI407zHnEscDiHHcRDDDPwNhfDPlzaUv4yh/KUMXQoYeoUy8w8/jmJYChQDbeB/omjueU89FYcu+0uUCi7/bQTNOzIPIEU3B5u6aMhQ4kIlm4vb8JmP26fko2Nl47be7erkvvMNNz+u8FzGNk5TrCmf2iaWDGzZHVG1dBPbBnx0RGNg7x7Ut1I8vxW3VcVs6pqtipqEVd2y97QTRVNeJ15mCxm7xbNZvte1Gn2u0ZIbZptvtD5tYCw2DFsSNU3XWnZ9q3R4lCjt5HkOLcmutxrNQaOlNgysydjABrMcr4iqktjJ8XHbu/zww1glzj9Ci1jzOWTcVyTc0MQOZlBRBm49nk2xzVn0puuu/aVAXs8y/v1wycai4HDi6l9H0OJWt4072BDVGtS72BoW7QO6oBg0H6bbjwW0Mcw4RTjg+QIEnOeSuVQg4L/5Hq1YCVgRLOBvoujWsY

                                                                                                                                                                                                    Static File Info

                                                                                                                                                                                                    General

                                                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                    Entropy (8bit):7.913845028849878
                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                    File name:BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    File size:1'446'992 bytes
                                                                                                                                                                                                    MD5:e3e7498c2436a1570109fbe755af1d40
                                                                                                                                                                                                    SHA1:d7fb79f465d2c87ef22088327b5bfb73899fdf7e
                                                                                                                                                                                                    SHA256:498e27ed4e5bb584672992f459c0e51cd1e7345889dff1521ccf577b13ed6313
                                                                                                                                                                                                    SHA512:4dd6025d4ebd1d4edeec077ee39e8704d2ed04ffd5f7ad83934a2ada8d0e3aefb15841b36ad0454e0c2cd6be12e13b2015de322d27059cb2fea8bb7f4a247096
                                                                                                                                                                                                    SSDEEP:24576:w2hOU0p4qlWfBTfmRfanIT6lUScOWFohEp6Vvn6qtndPVmatCkbpmp:zhOJpP4JTm5T6lkFohDB6sndPVa6g
                                                                                                                                                                                                    TLSH:C0652211B2D88031E6B31E3194F496755ABEFC741F30AA8F27849E3A5EB0582F674376
                                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........................Z.....................................................................~.............Rich...........

                                                                                                                                                                                                    File Icon

                                                                                                                                                                                                    Icon Hash:2f232d67b7934633

                                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Entrypoint:0x40699b
                                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                                    Digitally signed:true
                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                    Time Stamp:0x65E80F21 [Wed Mar 6 06:37:21 2024 UTC]
                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                                                    OS Version Minor:1
                                                                                                                                                                                                    File Version Major:5
                                                                                                                                                                                                    File Version Minor:1
                                                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                                                    Subsystem Version Minor:1
                                                                                                                                                                                                    Import Hash:c7edaf3f3d9b0b390b0f0473c7a8cf06

                                                                                                                                                                                                    Authenticode Signature

                                                                                                                                                                                                    Signature Valid:true
                                                                                                                                                                                                    Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                                    Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                    Error Number:0
                                                                                                                                                                                                    Not Before, Not After
                                                                                                                                                                                                    • 06/06/2023 01:00:00 08/08/2024 00:59:59
                                                                                                                                                                                                    Subject Chain
                                                                                                                                                                                                    • CN="Brave Software, Inc.", O="Brave Software, Inc.", L=San Francisco, S=California, C=US
                                                                                                                                                                                                    Version:3
                                                                                                                                                                                                    Thumbprint MD5:16D12EA31FCCA2DB434A4CE2764212FB
                                                                                                                                                                                                    Thumbprint SHA-1:8903F2BD47465A4F0F080AA7CEEC31A31B74DE42
                                                                                                                                                                                                    Thumbprint SHA-256:9422AAD6EED2524B47A4E58D835AC34009EA3B76DD25155EFCCBD0CDB6C1EE88
                                                                                                                                                                                                    Serial:031543E76CA971575EEDF22AA3719DCC

                                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                    call 00007F3140CED388h
                                                                                                                                                                                                    jmp 00007F3140CECF5Fh
                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                                    mov eax, dword ptr [ebp+08h]
                                                                                                                                                                                                    push esi
                                                                                                                                                                                                    mov ecx, dword ptr [eax+3Ch]
                                                                                                                                                                                                    add ecx, eax
                                                                                                                                                                                                    movzx eax, word ptr [ecx+14h]
                                                                                                                                                                                                    lea edx, dword ptr [ecx+18h]
                                                                                                                                                                                                    add edx, eax
                                                                                                                                                                                                    movzx eax, word ptr [ecx+06h]
                                                                                                                                                                                                    imul esi, eax, 28h
                                                                                                                                                                                                    add esi, edx
                                                                                                                                                                                                    cmp edx, esi
                                                                                                                                                                                                    je 00007F3140CED0FBh
                                                                                                                                                                                                    mov ecx, dword ptr [ebp+0Ch]
                                                                                                                                                                                                    cmp ecx, dword ptr [edx+0Ch]
                                                                                                                                                                                                    jc 00007F3140CED0ECh
                                                                                                                                                                                                    mov eax, dword ptr [edx+08h]
                                                                                                                                                                                                    add eax, dword ptr [edx+0Ch]
                                                                                                                                                                                                    cmp ecx, eax
                                                                                                                                                                                                    jc 00007F3140CED0EEh
                                                                                                                                                                                                    add edx, 28h
                                                                                                                                                                                                    cmp edx, esi
                                                                                                                                                                                                    jne 00007F3140CED0CCh
                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                    pop esi
                                                                                                                                                                                                    pop ebp
                                                                                                                                                                                                    ret
                                                                                                                                                                                                    mov eax, edx
                                                                                                                                                                                                    jmp 00007F3140CED0DBh
                                                                                                                                                                                                    push esi
                                                                                                                                                                                                    call 00007F3140CED86Ch
                                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                                    je 00007F3140CED102h
                                                                                                                                                                                                    mov eax, dword ptr fs:[00000018h]
                                                                                                                                                                                                    mov esi, 0042396Ch
                                                                                                                                                                                                    mov edx, dword ptr [eax+04h]
                                                                                                                                                                                                    jmp 00007F3140CED0E6h
                                                                                                                                                                                                    cmp edx, eax
                                                                                                                                                                                                    je 00007F3140CED0F2h
                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                    mov ecx, edx
                                                                                                                                                                                                    lock cmpxchg dword ptr [esi], ecx
                                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                                    jne 00007F3140CED0D2h
                                                                                                                                                                                                    xor al, al
                                                                                                                                                                                                    pop esi
                                                                                                                                                                                                    ret
                                                                                                                                                                                                    mov al, 01h
                                                                                                                                                                                                    pop esi
                                                                                                                                                                                                    ret
                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                                    cmp dword ptr [ebp+08h], 00000000h
                                                                                                                                                                                                    jne 00007F3140CED0E9h
                                                                                                                                                                                                    mov byte ptr [00423970h], 00000001h
                                                                                                                                                                                                    call 00007F3140CED65Ah
                                                                                                                                                                                                    call 00007F3140CEDBDEh
                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                    jne 00007F3140CED0E6h
                                                                                                                                                                                                    xor al, al
                                                                                                                                                                                                    pop ebp
                                                                                                                                                                                                    ret
                                                                                                                                                                                                    call 00007F3140CF0DC6h
                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                    jne 00007F3140CED0ECh
                                                                                                                                                                                                    push 00000000h
                                                                                                                                                                                                    call 00007F3140CEDBE5h
                                                                                                                                                                                                    pop ecx
                                                                                                                                                                                                    jmp 00007F3140CED0CBh
                                                                                                                                                                                                    mov al, 01h
                                                                                                                                                                                                    pop ebp
                                                                                                                                                                                                    ret
                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                                    cmp byte ptr [00423971h], 00000000h
                                                                                                                                                                                                    je 00007F3140CED0E6h
                                                                                                                                                                                                    mov al, 01h

                                                                                                                                                                                                    Data Directories

                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x21ae00x8c.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x250000x13673c.rsrc
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x15a0000x7450
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x15c0000x1508.reloc
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x20ce00x54.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x20e000x18.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x20d380x40.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x1a0000x1d4.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                    Sections

                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                    .text0x10000x18d200x18e00f6f6a8ebc9148ced19baf0cf8ce514c3False0.5874489635678392data6.645990561543334IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .rdata0x1a0000x85420x86003ed425119d83d29a9ea792647f00b190False0.4646688432835821data5.055308375977805IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .data0x230000x14540xa00905c57baa258d4dc27795aa058f06acaFalse0.175390625DOS executable (block device driver \277DN)2.379800202702836IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                    .rsrc0x250000x13673c0x136800ea570ee0e9f44be61c8e291d4d28b38dFalse0.9824376006441223data7.987680716387453IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .reloc0x15c0000x15080x1600c68100246f68f2ae3852dabe12991f75False0.7739701704545454data6.484253115308844IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                    Resources

                                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                    B0x258240x12e1f8LZMA compressed data, non-streamed, size 81696031.0003108978271484
                                                                                                                                                                                                    BRAVEUPDATE0x153a1c0x4data3.0
                                                                                                                                                                                                    RT_ICON0x153a200x128Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colorsEnglishUnited States0.6317567567567568
                                                                                                                                                                                                    RT_ICON0x153b480x568Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colorsEnglishUnited States0.5823699421965318
                                                                                                                                                                                                    RT_ICON0x1540b00x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colorsEnglishUnited States0.5120967741935484
                                                                                                                                                                                                    RT_ICON0x1543980x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.5455776173285198
                                                                                                                                                                                                    RT_ICON0x154c400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1536EnglishUnited States0.36341463414634145
                                                                                                                                                                                                    RT_ICON0x1552a80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2688EnglishUnited States0.42350746268656714
                                                                                                                                                                                                    RT_STRING0x1561500x13eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ArabicSaudi Arabia0.6446540880503144
                                                                                                                                                                                                    RT_STRING0x1562900x1aaMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0BulgarianBulgaria0.5
                                                                                                                                                                                                    RT_STRING0x15643c0x196Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0CatalanSpain0.49507389162561577
                                                                                                                                                                                                    RT_STRING0x1565d40xccMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ChineseTaiwan0.7205882352941176
                                                                                                                                                                                                    RT_STRING0x1566a00x18aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0CzechCzech Republic0.5152284263959391
                                                                                                                                                                                                    RT_STRING0x15682c0x15aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0DanishDenmark0.5144508670520231
                                                                                                                                                                                                    RT_STRING0x1569880x16aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0GermanGermany0.5276243093922652
                                                                                                                                                                                                    RT_STRING0x156af40x1b0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0GreekGreece0.5462962962962963
                                                                                                                                                                                                    RT_STRING0x156ca40x134Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0EnglishUnited States0.5324675324675324
                                                                                                                                                                                                    RT_STRING0x156dd80x188Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FinnishFinland0.5102040816326531
                                                                                                                                                                                                    RT_STRING0x156f600x1c0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FrenchFrance0.45535714285714285
                                                                                                                                                                                                    RT_STRING0x1571200x142Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0HebrewIsrael0.5590062111801242
                                                                                                                                                                                                    RT_STRING0x1572640x164Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0HungarianHungary0.550561797752809
                                                                                                                                                                                                    RT_STRING0x1573c80x150Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0IcelandicIceland0.5208333333333334
                                                                                                                                                                                                    RT_STRING0x1575180x1b0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ItalianItaly0.45601851851851855
                                                                                                                                                                                                    RT_STRING0x1576c80xfeMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0JapaneseJapan0.7125984251968503
                                                                                                                                                                                                    RT_STRING0x1577c80xf2Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0KoreanNorth Korea0.7231404958677686
                                                                                                                                                                                                    RT_STRING0x1577c80xf2Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0KoreanSouth Korea0.7231404958677686
                                                                                                                                                                                                    RT_STRING0x1578bc0x1b0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0DutchNetherlands0.44907407407407407
                                                                                                                                                                                                    RT_STRING0x157a6c0x180Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0NorwegianNorway0.4713541666666667
                                                                                                                                                                                                    RT_STRING0x157bec0x190Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0PolishPoland0.52
                                                                                                                                                                                                    RT_STRING0x157d7c0x15eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0PortugueseBrazil0.52
                                                                                                                                                                                                    RT_STRING0x157edc0x1c6Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0RomanianRomania0.4713656387665198
                                                                                                                                                                                                    RT_STRING0x1580a40x196Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0RussianRussia0.5492610837438424
                                                                                                                                                                                                    RT_STRING0x15823c0x19cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0CroatianCroatia0.470873786407767
                                                                                                                                                                                                    RT_STRING0x1583d80x180Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SlovakSlovakia0.5260416666666666
                                                                                                                                                                                                    RT_STRING0x1585580x1a0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SwedishSweden0.4639423076923077
                                                                                                                                                                                                    RT_STRING0x1586f80x15aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ThaiThailand0.6011560693641619
                                                                                                                                                                                                    RT_STRING0x1588540x15aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TurkishTurkey0.5260115606936416
                                                                                                                                                                                                    RT_STRING0x1589b00x12cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0UrduPakistan0.6366666666666667
                                                                                                                                                                                                    RT_STRING0x1589b00x12cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0UrduIndia0.6366666666666667
                                                                                                                                                                                                    RT_STRING0x158adc0x178Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0IndonesianIndonesia0.5079787234042553
                                                                                                                                                                                                    RT_STRING0x158c540x16eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0UkrainianUkrain0.5601092896174863
                                                                                                                                                                                                    RT_STRING0x158dc40x1bcMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SlovenianSlovenia0.4617117117117117
                                                                                                                                                                                                    RT_STRING0x158f800x14cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0EstonianEstonia0.5271084337349398
                                                                                                                                                                                                    RT_STRING0x1590cc0x1d8Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0LatvianLativa0.4661016949152542
                                                                                                                                                                                                    RT_STRING0x1592a40x188Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0LithuanianLithuania0.48214285714285715
                                                                                                                                                                                                    RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiIran0.5833333333333334
                                                                                                                                                                                                    RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiAfganistan0.5833333333333334
                                                                                                                                                                                                    RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiTajikistan0.5833333333333334
                                                                                                                                                                                                    RT_STRING0x15942c0x138Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FarsiUzbekistan0.5833333333333334
                                                                                                                                                                                                    RT_STRING0x1595640x158Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0VietnameseVietnam0.5406976744186046
                                                                                                                                                                                                    RT_STRING0x1596bc0x13cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0HindiIndia0.6139240506329114
                                                                                                                                                                                                    RT_STRING0x1597f80x15cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0MalayMalaysia0.5086206896551724
                                                                                                                                                                                                    RT_STRING0x1599540x172Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SwahiliKenya0.4972972972972973
                                                                                                                                                                                                    RT_STRING0x1599540x172Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SwahiliMozambiq0.4972972972972973
                                                                                                                                                                                                    RT_STRING0x159ac80x136Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0BengaliIndia0.6387096774193548
                                                                                                                                                                                                    RT_STRING0x159c000x152Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0GujaratiIndia0.621301775147929
                                                                                                                                                                                                    RT_STRING0x159d540x14eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TamilIndia0.6017964071856288
                                                                                                                                                                                                    RT_STRING0x159d540x14eMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TamilSri Lanka0.6017964071856288
                                                                                                                                                                                                    RT_STRING0x159ea40x154Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0TeluguIndia0.6176470588235294
                                                                                                                                                                                                    RT_STRING0x159ff80x156Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0KannadaKanada0.6403508771929824
                                                                                                                                                                                                    RT_STRING0x15a1500x19aMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0MalayalamIndia0.5292682926829269
                                                                                                                                                                                                    RT_STRING0x15a2ec0x178Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0MarathiIndia0.601063829787234
                                                                                                                                                                                                    RT_STRING0x15a4640xf0Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0AmharicEthiopia0.7541666666666667
                                                                                                                                                                                                    RT_STRING0x15a5540x17cMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0FilipinoPhilippines0.49473684210526314
                                                                                                                                                                                                    RT_STRING0x15a6d00xceMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0ChineseChina0.7233009708737864
                                                                                                                                                                                                    RT_STRING0x15a7a00x134Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0EnglishGreat Britain0.5324675324675324
                                                                                                                                                                                                    RT_STRING0x15a8d40x152Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SpanishMexico0.5118343195266272
                                                                                                                                                                                                    RT_STRING0x15aa280x188Matlab v4 mat-file (little endian) m, numeric, rows 0, columns 0PortuguesePortugal0.4872448979591837
                                                                                                                                                                                                    RT_STRING0x15abb00x1aaMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 00.48826291079812206
                                                                                                                                                                                                    RT_STRING0x15ad5c0x1beMatlab v4 mat-file (little endian) m, numeric, rows 0, columns 0SerbianCyrillic0.5
                                                                                                                                                                                                    RT_GROUP_ICON0x15af1c0x5adataEnglishUnited States0.7333333333333333
                                                                                                                                                                                                    RT_VERSION0x15af780x334dataEnglishUnited States0.4292682926829268
                                                                                                                                                                                                    RT_MANIFEST0x15b2ac0x48eXML 1.0 document, ASCII text0.43310463121783876

                                                                                                                                                                                                    Imports

                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                    KERNEL32.dllInitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, OutputDebugStringW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, GetSystemTimeAsFileTime, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, ReadFile, CreateFileW, CloseHandle, WriteConsoleW, DecodePointer, lstrcpynW, CreateEventW, WaitForSingleObjectEx, ResetEvent, GetCurrentThreadId, GetCurrentProcessId, IsValidCodePage, QueryPerformanceCounter, CreateDirectoryW, SizeofResource, lstrlenW, RemoveDirectoryW, GetTempPathW, FormatMessageW, LockResource, DeleteFileW, FindResourceExW, LoadResource, FindResourceW, HeapDestroy, LocalFree, VerSetConditionMask, CopyFileW, VerifyVersionInfoW, GetTempFileNameW, lstrcmpiW, UnmapViewOfFile, CreateFileMappingW, MapViewOfFile, VirtualQuery, SetFilePointer, WaitForSingleObject, CreateProcessW, GetExitCodeProcess, SetEvent
                                                                                                                                                                                                    SHLWAPI.dllPathQuoteSpacesW, PathAppendW, PathRemoveExtensionW, PathStripPathW
                                                                                                                                                                                                    ADVAPI32.dllRegCreateKeyExW, RegSetValueExW, RegCloseKey
                                                                                                                                                                                                    ole32.dllCoUninitialize, CoInitializeEx
                                                                                                                                                                                                    SHELL32.dllSHGetFolderPathW
                                                                                                                                                                                                    USER32.dllMessageBoxW, CharUpperBuffW, CharLowerBuffW

                                                                                                                                                                                                    Possible Origin

                                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                    EnglishUnited States
                                                                                                                                                                                                    ArabicSaudi Arabia
                                                                                                                                                                                                    BulgarianBulgaria
                                                                                                                                                                                                    CatalanSpain
                                                                                                                                                                                                    ChineseTaiwan
                                                                                                                                                                                                    CzechCzech Republic
                                                                                                                                                                                                    DanishDenmark
                                                                                                                                                                                                    GermanGermany
                                                                                                                                                                                                    GreekGreece
                                                                                                                                                                                                    FinnishFinland
                                                                                                                                                                                                    FrenchFrance
                                                                                                                                                                                                    HebrewIsrael
                                                                                                                                                                                                    HungarianHungary
                                                                                                                                                                                                    IcelandicIceland
                                                                                                                                                                                                    ItalianItaly
                                                                                                                                                                                                    JapaneseJapan
                                                                                                                                                                                                    KoreanNorth Korea
                                                                                                                                                                                                    KoreanSouth Korea
                                                                                                                                                                                                    DutchNetherlands
                                                                                                                                                                                                    NorwegianNorway
                                                                                                                                                                                                    PolishPoland
                                                                                                                                                                                                    PortugueseBrazil
                                                                                                                                                                                                    RomanianRomania
                                                                                                                                                                                                    RussianRussia
                                                                                                                                                                                                    CroatianCroatia
                                                                                                                                                                                                    SlovakSlovakia
                                                                                                                                                                                                    SwedishSweden
                                                                                                                                                                                                    ThaiThailand
                                                                                                                                                                                                    TurkishTurkey
                                                                                                                                                                                                    UrduPakistan
                                                                                                                                                                                                    UrduIndia
                                                                                                                                                                                                    IndonesianIndonesia
                                                                                                                                                                                                    UkrainianUkrain
                                                                                                                                                                                                    SlovenianSlovenia
                                                                                                                                                                                                    EstonianEstonia
                                                                                                                                                                                                    LatvianLativa
                                                                                                                                                                                                    LithuanianLithuania
                                                                                                                                                                                                    FarsiIran
                                                                                                                                                                                                    FarsiAfganistan
                                                                                                                                                                                                    FarsiTajikistan
                                                                                                                                                                                                    FarsiUzbekistan
                                                                                                                                                                                                    VietnameseVietnam
                                                                                                                                                                                                    MalayMalaysia
                                                                                                                                                                                                    SwahiliKenya
                                                                                                                                                                                                    SwahiliMozambiq
                                                                                                                                                                                                    TamilSri Lanka
                                                                                                                                                                                                    KannadaKanada
                                                                                                                                                                                                    AmharicEthiopia
                                                                                                                                                                                                    FilipinoPhilippines
                                                                                                                                                                                                    ChineseChina
                                                                                                                                                                                                    EnglishGreat Britain
                                                                                                                                                                                                    SpanishMexico
                                                                                                                                                                                                    PortuguesePortugal
                                                                                                                                                                                                    SerbianCyrillic

                                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                                    ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                    Statistics

                                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                    Behavior

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    System Behavior

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                                    Start time:09:25:16
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                    Imagebase:0x980000
                                                                                                                                                                                                    File size:1'446'992 bytes
                                                                                                                                                                                                    MD5 hash:E3E7498C2436A1570109FBE755AF1D40
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:1
                                                                                                                                                                                                    Start time:09:25:18
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:C:\Program Files (x86)\BraveSoftware\Temp\GUM21E4.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none
                                                                                                                                                                                                    Imagebase:0xaa0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                    • Detection: 0%, ReversingLabs
                                                                                                                                                                                                    • Detection: 1%, Virustotal, Browse
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:2
                                                                                                                                                                                                    Start time:09:25:21
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:3
                                                                                                                                                                                                    Start time:09:25:22
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:4
                                                                                                                                                                                                    Start time:09:25:22
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
                                                                                                                                                                                                    Imagebase:0x7ff65a330000
                                                                                                                                                                                                    File size:195'392 bytes
                                                                                                                                                                                                    MD5 hash:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                                    Start time:09:25:22
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
                                                                                                                                                                                                    Imagebase:0x7ff65a330000
                                                                                                                                                                                                    File size:195'392 bytes
                                                                                                                                                                                                    MD5 hash:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:6
                                                                                                                                                                                                    Start time:09:25:22
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:7
                                                                                                                                                                                                    Start time:09:25:22
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateComRegisterShell64.exe"
                                                                                                                                                                                                    Imagebase:0x7ff65a330000
                                                                                                                                                                                                    File size:195'392 bytes
                                                                                                                                                                                                    MD5 hash:F2CA542F38E6B51EDB9790369117F54A
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:8
                                                                                                                                                                                                    Start time:09:25:22
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                                    Start time:09:25:23
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /uninstall
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:10
                                                                                                                                                                                                    Start time:09:25:23
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTQ1IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE0NSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGOUMwOTg2Qy00NjYzLTQzNDUtQjFBNy1FQkE2Njc3OTA1RkV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RTc5NTUyNEYtOEU0Qi00RUYwLTgyOUUtOEZEQkZFODFDNTI4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjE0NSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI0ODI4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:11
                                                                                                                                                                                                    Start time:09:25:24
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{F9C0986C-4663-4345-B1A7-EBA6677905FE}
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                                    Start time:09:25:24
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:13
                                                                                                                                                                                                    Start time:09:25:25
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                    Imagebase:0x7ff6eef20000
                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:14
                                                                                                                                                                                                    Start time:09:25:30
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                                    Imagebase:0x70000
                                                                                                                                                                                                    File size:116'032 bytes
                                                                                                                                                                                                    MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:15
                                                                                                                                                                                                    Start time:09:25:30
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:16
                                                                                                                                                                                                    Start time:09:25:30
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                    Imagebase:0x7ff6a8650000
                                                                                                                                                                                                    File size:834'512 bytes
                                                                                                                                                                                                    MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:17
                                                                                                                                                                                                    Start time:09:25:30
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9474 /prefetch:2
                                                                                                                                                                                                    Imagebase:0x5c0000
                                                                                                                                                                                                    File size:828'368 bytes
                                                                                                                                                                                                    MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:18
                                                                                                                                                                                                    Start time:09:25:32
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
                                                                                                                                                                                                    Imagebase:0x7ff691f30000
                                                                                                                                                                                                    File size:540'712 bytes
                                                                                                                                                                                                    MD5 hash:89CF8972D683795DAB6901BC9456675D
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:19
                                                                                                                                                                                                    Start time:09:25:33
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
                                                                                                                                                                                                    Imagebase:0x7ff691f30000
                                                                                                                                                                                                    File size:540'712 bytes
                                                                                                                                                                                                    MD5 hash:89CF8972D683795DAB6901BC9456675D
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:20
                                                                                                                                                                                                    Start time:09:25:33
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                                    Imagebase:0xe0000
                                                                                                                                                                                                    File size:85'632 bytes
                                                                                                                                                                                                    MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                                    Start time:09:25:33
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                                    Imagebase:0xe0000
                                                                                                                                                                                                    File size:85'632 bytes
                                                                                                                                                                                                    MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:22
                                                                                                                                                                                                    Start time:09:25:33
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20458
                                                                                                                                                                                                    Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:23
                                                                                                                                                                                                    Start time:09:25:34
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:3
                                                                                                                                                                                                    Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:27
                                                                                                                                                                                                    Start time:09:25:36
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                                    Imagebase:0x70000
                                                                                                                                                                                                    File size:116'032 bytes
                                                                                                                                                                                                    MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:29
                                                                                                                                                                                                    Start time:09:25:37
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:30
                                                                                                                                                                                                    Start time:09:25:37
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6184 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
                                                                                                                                                                                                    Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:31
                                                                                                                                                                                                    Start time:09:25:37
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                    Imagebase:0x7ff6a8650000
                                                                                                                                                                                                    File size:834'512 bytes
                                                                                                                                                                                                    MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:32
                                                                                                                                                                                                    Start time:09:25:38
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75012 /prefetch:2
                                                                                                                                                                                                    Imagebase:0x5c0000
                                                                                                                                                                                                    File size:828'368 bytes
                                                                                                                                                                                                    MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:34
                                                                                                                                                                                                    Start time:09:25:39
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                                    Imagebase:0xe0000
                                                                                                                                                                                                    File size:85'632 bytes
                                                                                                                                                                                                    MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:35
                                                                                                                                                                                                    Start time:09:25:39
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                                                                                                                                    Imagebase:0xe0000
                                                                                                                                                                                                    File size:85'632 bytes
                                                                                                                                                                                                    MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:36
                                                                                                                                                                                                    Start time:09:25:42
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                                    Imagebase:0x70000
                                                                                                                                                                                                    File size:116'032 bytes
                                                                                                                                                                                                    MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:37
                                                                                                                                                                                                    Start time:09:25:42
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:38
                                                                                                                                                                                                    Start time:09:25:42
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
                                                                                                                                                                                                    Imagebase:0x7ff7acc30000
                                                                                                                                                                                                    File size:1'255'976 bytes
                                                                                                                                                                                                    MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:39
                                                                                                                                                                                                    Start time:09:25:42
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2060,i,8447288184623763065,7776466542653405030,262144 /prefetch:8
                                                                                                                                                                                                    Imagebase:0x7ff7acc30000
                                                                                                                                                                                                    File size:1'255'976 bytes
                                                                                                                                                                                                    MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:40
                                                                                                                                                                                                    Start time:09:25:43
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                    Imagebase:0x7ff6a8650000
                                                                                                                                                                                                    File size:834'512 bytes
                                                                                                                                                                                                    MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:41
                                                                                                                                                                                                    Start time:09:25:43
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:9480 /prefetch:2
                                                                                                                                                                                                    Imagebase:0x5c0000
                                                                                                                                                                                                    File size:828'368 bytes
                                                                                                                                                                                                    MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:42
                                                                                                                                                                                                    Start time:09:25:46
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:1578252 /prefetch:2
                                                                                                                                                                                                    Imagebase:0x5c0000
                                                                                                                                                                                                    File size:828'368 bytes
                                                                                                                                                                                                    MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:43
                                                                                                                                                                                                    Start time:09:25:50
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.145\BraveUpdateOnDemand.exe" -Embedding
                                                                                                                                                                                                    Imagebase:0x70000
                                                                                                                                                                                                    File size:116'032 bytes
                                                                                                                                                                                                    MD5 hash:088EBFFD13539DBEF1204243C3558999
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:44
                                                                                                                                                                                                    Start time:09:25:50
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                                                                                                                                                                                    Imagebase:0x9a0000
                                                                                                                                                                                                    File size:175'424 bytes
                                                                                                                                                                                                    MD5 hash:7ACF578621988C8B80F4D7EF7A12B89F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:45
                                                                                                                                                                                                    Start time:09:25:50
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                    Imagebase:0x7ff6a8650000
                                                                                                                                                                                                    File size:834'512 bytes
                                                                                                                                                                                                    MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:46
                                                                                                                                                                                                    Start time:09:25:51
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7376 CREDAT:75020 /prefetch:2
                                                                                                                                                                                                    Imagebase:0x5c0000
                                                                                                                                                                                                    File size:828'368 bytes
                                                                                                                                                                                                    MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:47
                                                                                                                                                                                                    Start time:09:25:58
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                                                                                                                                    Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:48
                                                                                                                                                                                                    Start time:09:25:59
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1788,i,66099047840648098,18039867653235187412,262144 /prefetch:3
                                                                                                                                                                                                    Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:49
                                                                                                                                                                                                    Start time:09:26:00
                                                                                                                                                                                                    Start date:14/03/2024
                                                                                                                                                                                                    Path:C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Program Files (x86)\BraveSoftware\Update\Install\{CE5CA43E-DC28-451A-B279-EE23A5AF3F0C}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Windows\TEMP\guiCA69.tmp
                                                                                                                                                                                                    Imagebase:0x7ff6ecf50000
                                                                                                                                                                                                    File size:124'775'448 bytes
                                                                                                                                                                                                    MD5 hash:40976C35E6CA27871F134A8A2FCAFC21
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    Disassembly

                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:9.8%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:6.8%
                                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                                      Total number of Limit Nodes:31
                                                                                                                                                                                                      execution_graph 12141 98681f 12142 98682b __FrameHandler3::FrameUnwindToState 12141->12142 12169 986a1b 12142->12169 12144 986832 12145 986985 12144->12145 12153 98685c ___scrt_is_nonwritable_in_current_image __CreateFrameInfo ___scrt_release_startup_lock 12144->12153 12238 986d06 IsProcessorFeaturePresent 12145->12238 12147 98698c 12217 98a133 12147->12217 12152 98687b 12153->12152 12154 9868fc 12153->12154 12220 98a10d 12153->12220 12177 986e21 12154->12177 12164 986922 12165 98692b 12164->12165 12229 98a0e8 12164->12229 12232 986b8c 12165->12232 12170 986a24 12169->12170 12245 986fa5 IsProcessorFeaturePresent 12170->12245 12174 986a39 12174->12144 12175 986a35 12175->12174 12255 98754d 12175->12255 12317 987760 12177->12317 12180 986902 12181 989d7a 12180->12181 12319 98ed7d 12181->12319 12183 98690a 12186 98277b GetModuleHandleW GetProcAddress 12183->12186 12184 989d83 12184->12183 12325 98f0b1 12184->12325 12187 9827a0 12186->12187 12188 9827a7 CoInitializeEx 12186->12188 12187->12188 12189 9827ba 12188->12189 12195 9827c5 12188->12195 12746 981444 12189->12746 12194 9827d5 12751 982604 12194->12751 12902 98254e 12195->12902 12207 98280f 12208 982bff 59 API calls 12207->12208 12209 982828 12208->12209 12210 982bff 59 API calls 12209->12210 12211 982831 12210->12211 12806 981935 12211->12806 13971 989f5e 12217->13971 12221 98a123 __dosmaperr 12220->12221 12222 98a7c4 __FrameHandler3::FrameUnwindToState 12220->12222 12221->12154 12223 98d6f0 _unexpected 43 API calls 12222->12223 12226 98a7d5 12223->12226 12224 98a880 __FrameHandler3::FrameUnwindToState 43 API calls 12225 98a7ff 12224->12225 12226->12224 12227 986e57 GetModuleHandleW 12228 98691e 12227->12228 12228->12147 12228->12164 12230 989f5e __CreateFrameInfo 23 API calls 12229->12230 12231 98a0f3 12230->12231 12231->12165 12233 986b98 12232->12233 12234 986933 12233->12234 14046 98a735 12233->14046 12234->12152 12236 986ba6 12237 98754d ___scrt_uninitialize_crt 7 API calls 12236->12237 12237->12234 12239 986d1c __CreateFrameInfo 12238->12239 12240 986dc7 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 12239->12240 12241 986e12 __CreateFrameInfo 12240->12241 12241->12147 12242 98a0f7 12243 989f5e __CreateFrameInfo 23 API calls 12242->12243 12244 98699a 12243->12244 12246 986a30 12245->12246 12247 98752e 12246->12247 12261 987b61 12247->12261 12250 987537 12250->12175 12252 98753f 12253 98754a 12252->12253 12275 987b9d 12252->12275 12253->12175 12256 987560 12255->12256 12257 987556 12255->12257 12256->12174 12258 987b46 ___vcrt_uninitialize_ptd 6 API calls 12257->12258 12259 98755b 12258->12259 12260 987b9d ___vcrt_uninitialize_locks DeleteCriticalSection 12259->12260 12260->12256 12263 987b6a 12261->12263 12264 987b93 12263->12264 12265 987533 12263->12265 12279 987dd5 12263->12279 12266 987b9d ___vcrt_uninitialize_locks DeleteCriticalSection 12264->12266 12265->12250 12267 987b13 12265->12267 12266->12265 12298 987ce6 12267->12298 12272 987b43 12272->12252 12274 987b28 12274->12252 12276 987bc7 12275->12276 12277 987ba8 12275->12277 12276->12250 12278 987bb2 DeleteCriticalSection 12277->12278 12278->12276 12278->12278 12284 987c9d 12279->12284 12282 987e0d InitializeCriticalSectionAndSpinCount 12283 987df8 12282->12283 12283->12263 12285 987cb5 12284->12285 12289 987cd8 12284->12289 12285->12289 12290 987c03 12285->12290 12288 987cca GetProcAddress 12288->12289 12289->12282 12289->12283 12291 987c0f 12290->12291 12292 987c83 12291->12292 12293 987c25 LoadLibraryExW 12291->12293 12297 987c65 LoadLibraryExW 12291->12297 12292->12288 12292->12289 12294 987c8a 12293->12294 12295 987c43 GetLastError 12293->12295 12294->12292 12296 987c92 FreeLibrary 12294->12296 12295->12291 12296->12292 12297->12291 12297->12294 12299 987c9d ___vcrt_FlsFree 5 API calls 12298->12299 12300 987d00 12299->12300 12301 987d19 TlsAlloc 12300->12301 12302 987b1d 12300->12302 12302->12274 12303 987d97 12302->12303 12304 987c9d ___vcrt_FlsFree 5 API calls 12303->12304 12305 987db1 12304->12305 12306 987dcc TlsSetValue 12305->12306 12307 987b36 12305->12307 12306->12307 12307->12272 12308 987b46 12307->12308 12309 987b56 12308->12309 12310 987b50 12308->12310 12309->12274 12312 987d21 12310->12312 12313 987c9d ___vcrt_FlsFree 5 API calls 12312->12313 12314 987d3b 12313->12314 12315 987d53 TlsFree 12314->12315 12316 987d47 12314->12316 12315->12316 12316->12309 12318 986e34 GetStartupInfoW 12317->12318 12318->12180 12320 98edb8 12319->12320 12321 98ed86 12319->12321 12320->12184 12328 98d7ab 12321->12328 12743 98f061 12325->12743 12329 98d7b6 12328->12329 12332 98d7bc 12328->12332 12330 99054a __dosmaperr 6 API calls 12329->12330 12330->12332 12331 990589 __dosmaperr 6 API calls 12333 98d7d6 12331->12333 12332->12331 12334 98d7c2 12332->12334 12333->12334 12336 98dd11 __dosmaperr 14 API calls 12333->12336 12335 98d7c7 12334->12335 12376 98a880 12334->12376 12353 98eb88 12335->12353 12338 98d7e6 12336->12338 12340 98d7ee 12338->12340 12341 98d803 12338->12341 12343 990589 __dosmaperr 6 API calls 12340->12343 12342 990589 __dosmaperr 6 API calls 12341->12342 12344 98d80f 12342->12344 12345 98d7fa 12343->12345 12346 98d822 12344->12346 12347 98d813 12344->12347 12350 98dd6e __freea 14 API calls 12345->12350 12349 98d51e __dosmaperr 14 API calls 12346->12349 12348 990589 __dosmaperr 6 API calls 12347->12348 12348->12345 12351 98d82d 12349->12351 12350->12334 12352 98dd6e __freea 14 API calls 12351->12352 12352->12335 12541 98ecdd 12353->12541 12358 98ebcb 12358->12320 12361 98ebf2 12566 98edd8 12361->12566 12362 98ebe4 12363 98dd6e __freea 14 API calls 12362->12363 12363->12358 12366 98ec2a 12367 98dcfe __dosmaperr 14 API calls 12366->12367 12368 98ec2f 12367->12368 12371 98dd6e __freea 14 API calls 12368->12371 12369 98ec71 12370 98ecba 12369->12370 12577 98e7fa 12369->12577 12375 98dd6e __freea 14 API calls 12370->12375 12371->12358 12372 98ec45 12372->12369 12373 98dd6e __freea 14 API calls 12372->12373 12373->12369 12375->12358 12387 990980 12376->12387 12380 98a89a IsProcessorFeaturePresent 12383 98a8a6 12380->12383 12381 98a0f7 __CreateFrameInfo 23 API calls 12384 98a8c3 12381->12384 12382 98a890 12382->12380 12386 98a8b9 12382->12386 12417 98da04 12383->12417 12386->12381 12423 9908b2 12387->12423 12390 9909c5 12391 9909d1 __FrameHandler3::FrameUnwindToState 12390->12391 12392 98d841 __dosmaperr 14 API calls 12391->12392 12393 9909f8 __CreateFrameInfo 12391->12393 12397 9909fe __CreateFrameInfo 12391->12397 12392->12393 12394 990a45 12393->12394 12393->12397 12416 990a2f 12393->12416 12395 98dcfe __dosmaperr 14 API calls 12394->12395 12396 990a4a 12395->12396 12434 98dc00 12396->12434 12399 990a71 12397->12399 12436 98f32d EnterCriticalSection 12397->12436 12402 990ab3 12399->12402 12403 990ba4 12399->12403 12413 990ae2 12399->12413 12402->12413 12437 98d6f0 GetLastError 12402->12437 12404 990baf 12403->12404 12468 98f375 LeaveCriticalSection 12403->12468 12407 98a0f7 __CreateFrameInfo 23 API calls 12404->12407 12409 990bb7 12407->12409 12410 98d6f0 _unexpected 43 API calls 12414 990b37 12410->12414 12412 98d6f0 _unexpected 43 API calls 12412->12413 12464 990b51 12413->12464 12415 98d6f0 _unexpected 43 API calls 12414->12415 12414->12416 12415->12416 12416->12382 12418 98da20 __CreateFrameInfo 12417->12418 12419 98da4c IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 12418->12419 12422 98db1d __CreateFrameInfo 12419->12422 12421 98db3b 12421->12386 12533 987182 12422->12533 12424 9908be __FrameHandler3::FrameUnwindToState 12423->12424 12429 98f32d EnterCriticalSection 12424->12429 12426 9908cc 12430 99090a 12426->12430 12429->12426 12433 98f375 LeaveCriticalSection 12430->12433 12432 98a885 12432->12382 12432->12390 12433->12432 12469 98db4c 12434->12469 12436->12399 12438 98d70c 12437->12438 12439 98d706 12437->12439 12441 990589 __dosmaperr 6 API calls 12438->12441 12443 98d710 SetLastError 12438->12443 12440 99054a __dosmaperr 6 API calls 12439->12440 12440->12438 12442 98d728 12441->12442 12442->12443 12445 98dd11 __dosmaperr 14 API calls 12442->12445 12447 98d7a0 12443->12447 12448 98d7a5 12443->12448 12446 98d73d 12445->12446 12449 98d745 12446->12449 12450 98d756 12446->12450 12447->12412 12451 98a880 __FrameHandler3::FrameUnwindToState 41 API calls 12448->12451 12452 990589 __dosmaperr 6 API calls 12449->12452 12453 990589 __dosmaperr 6 API calls 12450->12453 12454 98d7aa 12451->12454 12455 98d753 12452->12455 12456 98d762 12453->12456 12461 98dd6e __freea 14 API calls 12455->12461 12457 98d77d 12456->12457 12458 98d766 12456->12458 12459 98d51e __dosmaperr 14 API calls 12457->12459 12460 990589 __dosmaperr 6 API calls 12458->12460 12462 98d788 12459->12462 12460->12455 12461->12443 12463 98dd6e __freea 14 API calls 12462->12463 12463->12443 12465 990b28 12464->12465 12466 990b57 12464->12466 12465->12410 12465->12414 12465->12416 12532 98f375 LeaveCriticalSection 12466->12532 12468->12404 12470 98db5e ___std_exception_copy 12469->12470 12475 98db83 12470->12475 12476 98db9a 12475->12476 12477 98db93 12475->12477 12481 98db76 12476->12481 12494 98d9db 12476->12494 12490 98be90 GetLastError 12477->12490 12480 98dbcf 12480->12481 12497 98dc2d IsProcessorFeaturePresent 12480->12497 12484 98bce0 12481->12484 12483 98dbff 12485 98bcec 12484->12485 12486 98bd03 12485->12486 12523 98bee0 12485->12523 12488 98bee0 ___std_exception_copy 43 API calls 12486->12488 12489 98bd16 12486->12489 12488->12489 12491 98bea9 12490->12491 12501 98d8f2 12491->12501 12495 98d9ff 12494->12495 12496 98d9e6 GetLastError SetLastError 12494->12496 12495->12480 12496->12480 12498 98dc39 12497->12498 12499 98da04 __CreateFrameInfo 8 API calls 12498->12499 12500 98dc4e GetCurrentProcess TerminateProcess 12499->12500 12500->12483 12502 98d90b 12501->12502 12503 98d905 12501->12503 12505 990589 __dosmaperr 6 API calls 12502->12505 12522 98bec5 SetLastError 12502->12522 12504 99054a __dosmaperr 6 API calls 12503->12504 12504->12502 12506 98d925 12505->12506 12507 98dd11 __dosmaperr 14 API calls 12506->12507 12506->12522 12508 98d935 12507->12508 12509 98d93d 12508->12509 12510 98d952 12508->12510 12512 990589 __dosmaperr 6 API calls 12509->12512 12511 990589 __dosmaperr 6 API calls 12510->12511 12513 98d95e 12511->12513 12514 98d949 12512->12514 12515 98d971 12513->12515 12516 98d962 12513->12516 12517 98dd6e __freea 14 API calls 12514->12517 12519 98d51e __dosmaperr 14 API calls 12515->12519 12518 990589 __dosmaperr 6 API calls 12516->12518 12517->12522 12518->12514 12520 98d97c 12519->12520 12521 98dd6e __freea 14 API calls 12520->12521 12521->12522 12522->12476 12524 98beee GetLastError 12523->12524 12525 98bf2f 12523->12525 12526 98befd 12524->12526 12525->12486 12527 98d8f2 ___std_exception_copy 14 API calls 12526->12527 12528 98bf1a SetLastError 12527->12528 12528->12525 12529 98bf36 12528->12529 12530 98a880 __FrameHandler3::FrameUnwindToState 41 API calls 12529->12530 12531 98bf3b 12530->12531 12532->12465 12534 98718a 12533->12534 12535 98718b IsProcessorFeaturePresent 12533->12535 12534->12421 12537 9871cd 12535->12537 12540 987190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 12537->12540 12539 9872b0 12539->12421 12540->12539 12542 98ece9 __FrameHandler3::FrameUnwindToState 12541->12542 12545 98ed03 12542->12545 12585 98f32d EnterCriticalSection 12542->12585 12544 98ebb2 12552 98e908 12544->12552 12545->12544 12548 98a880 __FrameHandler3::FrameUnwindToState 43 API calls 12545->12548 12546 98ed3f 12586 98ed5c 12546->12586 12549 98ed7c 12548->12549 12550 98ed13 12550->12546 12551 98dd6e __freea 14 API calls 12550->12551 12551->12546 12590 98e408 12552->12590 12555 98e929 GetOEMCP 12557 98e952 12555->12557 12556 98e93b 12556->12557 12558 98e940 GetACP 12556->12558 12557->12358 12559 98fae8 12557->12559 12558->12557 12560 98fb26 12559->12560 12561 98faf6 __dosmaperr 12559->12561 12562 98dcfe __dosmaperr 14 API calls 12560->12562 12561->12560 12563 98fb11 RtlAllocateHeap 12561->12563 12565 990829 __dosmaperr 2 API calls 12561->12565 12564 98ebdc 12562->12564 12563->12561 12563->12564 12564->12361 12564->12362 12565->12561 12567 98e908 45 API calls 12566->12567 12568 98edf8 12567->12568 12569 98ee71 __CreateFrameInfo 12568->12569 12571 98ee35 IsValidCodePage 12568->12571 12570 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12569->12570 12572 98ec1f 12570->12572 12571->12569 12573 98ee47 12571->12573 12572->12366 12572->12372 12574 98ee76 GetCPInfo 12573->12574 12576 98ee50 __CreateFrameInfo 12573->12576 12574->12569 12574->12576 12633 98e9dc 12576->12633 12578 98e806 __FrameHandler3::FrameUnwindToState 12577->12578 12717 98f32d EnterCriticalSection 12578->12717 12580 98e810 12718 98e847 12580->12718 12585->12550 12589 98f375 LeaveCriticalSection 12586->12589 12588 98ed63 12588->12545 12589->12588 12591 98e41f 12590->12591 12592 98e426 12590->12592 12591->12555 12591->12556 12592->12591 12593 98d6f0 _unexpected 43 API calls 12592->12593 12594 98e447 12593->12594 12598 9914cc 12594->12598 12599 9914df 12598->12599 12600 98e45d 12598->12600 12599->12600 12606 990200 12599->12606 12602 99152a 12600->12602 12603 991552 12602->12603 12604 99153d 12602->12604 12603->12591 12604->12603 12628 98edc5 12604->12628 12607 99020c __FrameHandler3::FrameUnwindToState 12606->12607 12608 98d6f0 _unexpected 43 API calls 12607->12608 12609 990215 12608->12609 12610 99025b 12609->12610 12619 98f32d EnterCriticalSection 12609->12619 12610->12600 12612 990233 12620 990281 12612->12620 12617 98a880 __FrameHandler3::FrameUnwindToState 43 API calls 12618 990280 12617->12618 12619->12612 12621 990244 12620->12621 12622 99028f __dosmaperr 12620->12622 12624 990260 12621->12624 12622->12621 12623 98ffb4 __dosmaperr 14 API calls 12622->12623 12623->12621 12627 98f375 LeaveCriticalSection 12624->12627 12626 990257 12626->12610 12626->12617 12627->12626 12629 98d6f0 _unexpected 43 API calls 12628->12629 12630 98edca 12629->12630 12631 98ecdd ___scrt_uninitialize_crt 43 API calls 12630->12631 12632 98edd5 12631->12632 12632->12603 12634 98ea04 GetCPInfo 12633->12634 12643 98eacd 12633->12643 12639 98ea1c 12634->12639 12634->12643 12635 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12637 98eb86 12635->12637 12637->12569 12644 98fe0e 12639->12644 12642 992b92 47 API calls 12642->12643 12643->12635 12645 98e408 43 API calls 12644->12645 12646 98fe2e 12645->12646 12664 98f0e2 12646->12664 12648 98fef2 12651 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12648->12651 12649 98feea 12667 98ff17 12649->12667 12650 98fe5b 12650->12648 12650->12649 12653 98fae8 15 API calls 12650->12653 12655 98fe80 __CreateFrameInfo __alloca_probe_16 12650->12655 12654 98ea84 12651->12654 12653->12655 12659 992b92 12654->12659 12655->12649 12656 98f0e2 ___scrt_uninitialize_crt MultiByteToWideChar 12655->12656 12657 98fecb 12656->12657 12657->12649 12658 98fed6 GetStringTypeW 12657->12658 12658->12649 12660 98e408 43 API calls 12659->12660 12661 992ba5 12660->12661 12671 9929a4 12661->12671 12665 98f0f3 MultiByteToWideChar 12664->12665 12665->12650 12668 98ff23 12667->12668 12669 98ff34 12667->12669 12668->12669 12670 98dd6e __freea 14 API calls 12668->12670 12669->12648 12670->12669 12672 9929bf 12671->12672 12673 98f0e2 ___scrt_uninitialize_crt MultiByteToWideChar 12672->12673 12676 992a05 12673->12676 12674 992b7d 12675 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12674->12675 12677 98eaa5 12675->12677 12676->12674 12678 98fae8 15 API calls 12676->12678 12680 992a2b __alloca_probe_16 12676->12680 12691 992ab1 12676->12691 12677->12642 12678->12680 12679 98ff17 __freea 14 API calls 12679->12674 12681 98f0e2 ___scrt_uninitialize_crt MultiByteToWideChar 12680->12681 12680->12691 12682 992a70 12681->12682 12682->12691 12699 990616 12682->12699 12685 992ada 12686 992b65 12685->12686 12688 98fae8 15 API calls 12685->12688 12692 992aec __alloca_probe_16 12685->12692 12689 98ff17 __freea 14 API calls 12686->12689 12687 992aa2 12690 990616 6 API calls 12687->12690 12687->12691 12688->12692 12689->12691 12690->12691 12691->12679 12692->12686 12693 990616 6 API calls 12692->12693 12694 992b2f 12693->12694 12694->12686 12705 98f15e 12694->12705 12696 992b49 12696->12686 12697 992b52 12696->12697 12698 98ff17 __freea 14 API calls 12697->12698 12698->12691 12708 9902eb 12699->12708 12703 990667 LCMapStringW 12704 990627 12703->12704 12704->12685 12704->12687 12704->12691 12707 98f175 WideCharToMultiByte 12705->12707 12707->12696 12709 9903ea __dosmaperr 5 API calls 12708->12709 12710 990301 12709->12710 12710->12704 12711 990673 12710->12711 12714 990305 12711->12714 12713 99067e 12713->12703 12715 9903ea __dosmaperr 5 API calls 12714->12715 12716 99031b 12715->12716 12716->12713 12717->12580 12728 98efe0 12718->12728 12720 98e869 12721 98efe0 43 API calls 12720->12721 12723 98e888 12721->12723 12722 98e81d 12725 98e83b 12722->12725 12723->12722 12724 98dd6e __freea 14 API calls 12723->12724 12724->12722 12742 98f375 LeaveCriticalSection 12725->12742 12727 98e829 12727->12370 12729 98eff1 12728->12729 12732 98efed __InternalCxxFrameHandler 12728->12732 12730 98eff8 12729->12730 12734 98f00b __CreateFrameInfo 12729->12734 12731 98dcfe __dosmaperr 14 API calls 12730->12731 12733 98effd 12731->12733 12732->12720 12735 98dc00 ___std_exception_copy 43 API calls 12733->12735 12734->12732 12736 98f039 12734->12736 12737 98f042 12734->12737 12735->12732 12738 98dcfe __dosmaperr 14 API calls 12736->12738 12737->12732 12740 98dcfe __dosmaperr 14 API calls 12737->12740 12739 98f03e 12738->12739 12741 98dc00 ___std_exception_copy 43 API calls 12739->12741 12740->12739 12741->12732 12742->12727 12744 98e408 43 API calls 12743->12744 12745 98f074 12744->12745 12745->12184 12747 987760 __CreateFrameInfo 12746->12747 12748 981483 VerSetConditionMask VerSetConditionMask VerSetConditionMask VerifyVersionInfoW 12747->12748 12749 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12748->12749 12750 9814e6 12749->12750 12750->12194 12750->12195 12752 982b50 68 API calls 12751->12752 12753 982625 12752->12753 12930 982f5f 12753->12930 12755 982635 __CreateFrameInfo 12756 9826d9 12755->12756 12759 98264f GetModuleFileNameW 12755->12759 12757 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12756->12757 12758 9826e7 12757->12758 12764 9826e9 12758->12764 12759->12756 12760 98266a 12759->12760 12760->12756 12761 98266e RegCreateKeyExW 12760->12761 12761->12756 12762 982699 lstrlenW RegSetValueExW 12761->12762 12762->12756 12763 9826cd RegCloseKey 12762->12763 12763->12756 12765 987760 __CreateFrameInfo 12764->12765 12766 982713 GetModuleFileNameW 12765->12766 12767 98275f 12766->12767 12768 98272f 12766->12768 12769 982ba0 66 API calls 12767->12769 12768->12767 12770 982733 12768->12770 12771 98275d 12769->12771 12772 982ba0 66 API calls 12770->12772 12773 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12771->12773 12774 982745 12772->12774 12775 982779 12773->12775 12937 984b06 12774->12937 12779 982b50 12775->12779 12778 982f5f RtlFreeHeap 12778->12771 13004 9811d5 12779->13004 12782 982b61 12786 982b86 12782->12786 12787 982b79 12782->12787 12783 982b95 12784 98103b RaiseException 12783->12784 12785 982b9f 12784->12785 13019 982dc4 12786->13019 13028 9829de 12787->13028 12790 9827f9 12791 982bff 12790->12791 12792 9811d5 58 API calls 12791->12792 12793 982c07 12792->12793 12794 982802 12793->12794 12795 98103b RaiseException 12793->12795 12797 982ba0 12794->12797 12796 982c25 12795->12796 12798 9811d5 58 API calls 12797->12798 12799 982bac 12798->12799 12800 982bf4 12799->12800 12803 982bb2 12799->12803 12801 98103b RaiseException 12800->12801 12802 982bfe 12801->12802 12804 9829de 51 API calls 12803->12804 12805 982bd6 12803->12805 12804->12805 12805->12207 13187 981edd IsUserAnAdmin 12806->13187 12809 98195d 12813 981961 12809->12813 13211 982024 12809->13211 12815 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12813->12815 12816 981cdd 12815->12816 12879 9818b8 12816->12879 12818 98198e 12819 981ad5 12818->12819 12820 9819f1 12818->12820 13236 983555 12818->13236 13338 983520 12819->13338 13265 982132 12820->13265 12825 982f7a 14 API calls 12826 981a20 12825->12826 12827 982c26 RaiseException 12826->12827 12828 981a48 PathQuoteSpacesW 12827->12828 13283 9828b9 12828->13283 12830 981a60 __CreateFrameInfo 12831 981a73 GetModuleFileNameW 12830->12831 12832 981a8a 12831->12832 12833 981a99 12831->12833 12832->12833 13287 981570 12832->13287 12834 981aba 12833->12834 12835 981c0e 12833->12835 12837 981ada 12834->12837 12838 981abe 12834->12838 12839 9814eb 63 API calls 12835->12839 12841 982b50 68 API calls 12837->12841 12840 98254e 74 API calls 12838->12840 12842 981c20 12839->12842 12843 981aca 12840->12843 12844 981ae6 12841->12844 13389 981cdf 12842->13389 12846 982f5f RtlFreeHeap 12843->12846 12847 982bff 59 API calls 12844->12847 12846->12819 12849 981af1 12847->12849 12848 981c06 13307 981db4 12848->13307 13298 982aa0 12849->13298 12852 981c8d 13322 9837e2 12852->13322 12856 982b50 68 API calls 12859 981c51 12856->12859 12857 981ca2 12860 982f5f RtlFreeHeap 12857->12860 12858 982f5f RtlFreeHeap 12861 981b42 12858->12861 12866 9814eb 63 API calls 12859->12866 12860->12819 12862 981b4a 12861->12862 12863 981bcd 12861->12863 13358 982a5b 12862->13358 12864 9814eb 63 API calls 12863->12864 12867 981bcb 12864->12867 12869 981c7f 12866->12869 12872 982f5f RtlFreeHeap 12867->12872 12871 982f5f RtlFreeHeap 12869->12871 12871->12852 12873 981bfb 12872->12873 12874 982f5f RtlFreeHeap 12873->12874 12874->12848 12875 981b7e _strncpy 13376 9814eb 12875->13376 12880 9818c9 12879->12880 12891 9818ff 12879->12891 12881 9818e6 12880->12881 12882 9828df RaiseException 12880->12882 12883 982904 15 API calls 12881->12883 12885 9818d8 DeleteFileW 12882->12885 12886 9818ed RemoveDirectoryW 12883->12886 12884 982f5f RtlFreeHeap 12887 98190c 12884->12887 12885->12880 12885->12881 12889 982c62 44 API calls 12886->12889 12888 982f5f RtlFreeHeap 12887->12888 12890 981913 12888->12890 12889->12891 12892 982904 15 API calls 12890->12892 12891->12884 12893 98191a 12892->12893 12894 982f5f RtlFreeHeap 12893->12894 12895 981922 12894->12895 12896 982f5f RtlFreeHeap 12895->12896 12897 98192a 12896->12897 12898 9829ca 12899 982857 12898->12899 12900 9829d2 12898->12900 12899->12227 12900->12899 12901 9829d7 CoUninitialize 12900->12901 12901->12899 12903 982bff 59 API calls 12902->12903 12904 982560 12903->12904 12905 98257c 12904->12905 12906 98256d 12904->12906 12908 982bff 59 API calls 12905->12908 12907 9829de 51 API calls 12906->12907 12910 98257a 12907->12910 12909 982584 12908->12909 12911 9829de 51 API calls 12909->12911 12912 982bff 59 API calls 12910->12912 12913 98258d 12911->12913 12914 9825b1 12912->12914 13937 98324d 12913->13937 12916 982bff 59 API calls 12914->12916 12918 9825b9 12916->12918 12917 98259e 12919 982f5f RtlFreeHeap 12917->12919 12920 9829de 51 API calls 12918->12920 12919->12910 12921 9825c2 12920->12921 12922 98324d 73 API calls 12921->12922 12923 9825d3 12922->12923 12924 982f5f RtlFreeHeap 12923->12924 12925 9825de MessageBoxW 12924->12925 12926 982f5f RtlFreeHeap 12925->12926 12927 9825f6 12926->12927 12928 982f5f RtlFreeHeap 12927->12928 12929 9825fe 12928->12929 12929->12898 12931 982f79 12930->12931 12932 982f71 12930->12932 12931->12755 12934 98114d 12932->12934 12935 981164 12934->12935 12936 981156 RtlFreeHeap 12934->12936 12935->12931 12936->12935 12938 982bff 59 API calls 12937->12938 12939 984b19 12938->12939 12959 983a75 lstrcpynW PathStripPathW PathRemoveExtensionW lstrlenW 12939->12959 12942 984b70 12943 982ba0 66 API calls 12942->12943 12958 984b69 12943->12958 12946 982f5f RtlFreeHeap 12949 982752 12946->12949 12949->12778 12958->12946 12960 983ae7 12959->12960 12961 983ad5 lstrlenW 12959->12961 12960->12961 12964 983b1a 12960->12964 12965 983b76 12960->12965 12962 983b26 12961->12962 12963 983b39 12962->12963 12966 983b3b lstrlenW 12962->12966 12979 983939 lstrlenW 12963->12979 12964->12961 12989 9872b2 12965->12989 12966->12963 12970 983b51 12971 983b62 12970->12971 12983 9839c5 lstrlenW 12970->12983 12973 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 12971->12973 12974 983b74 12973->12974 12974->12942 12975 982c26 12974->12975 12976 982c57 12975->12976 12997 98103b 12976->12997 12980 983952 12979->12980 12981 983963 lstrlenW 12980->12981 12982 98396e 12980->12982 12981->12982 12982->12970 12984 9839e3 12983->12984 12985 983a12 lstrlenW 12984->12985 12988 9839fa 12984->12988 12986 983a26 12985->12986 12985->12988 12987 983a47 lstrlenW 12986->12987 12986->12988 12987->12986 12987->12988 12988->12971 12992 9872be IsProcessorFeaturePresent 12989->12992 12993 9872d3 12992->12993 12996 987190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 12993->12996 12995 983b7b 12996->12995 13003 981026 RaiseException 12997->13003 12999 98107a 13000 98103b RaiseException 13002 981096 13000->13002 13001 98105b 13001->12999 13001->13000 13003->13001 13005 981203 13004->13005 13006 9811ec 13004->13006 13037 9986c5 EnterCriticalSection 13005->13037 13009 9986c5 6 API calls 13006->13009 13018 9811fe 13006->13018 13008 98120e 13008->13006 13010 981218 GetProcessHeap 13008->13010 13011 981253 13009->13011 13042 986be1 13010->13042 13014 986be1 46 API calls 13011->13014 13011->13018 13016 9812a0 13014->13016 13017 99867b __Init_thread_footer 5 API calls 13016->13017 13017->13018 13018->12782 13018->12783 13020 982e0d 13019->13020 13021 982dd1 MultiByteToWideChar 13019->13021 13144 982c62 13020->13144 13021->13020 13022 982dea 13021->13022 13024 982c26 RaiseException 13022->13024 13026 982df2 MultiByteToWideChar 13024->13026 13025 982e0b 13025->12790 13118 982e7d 13026->13118 13148 99805d EnterCriticalSection 13028->13148 13030 982a50 13030->12790 13031 982a09 FindResourceExW 13034 9829f3 13031->13034 13033 99805d 3 API calls 13033->13034 13034->13030 13034->13031 13034->13033 13035 982a41 13034->13035 13153 9810bf LoadResource 13034->13153 13035->13030 13157 982d36 FindResourceW 13035->13157 13038 9986d9 13037->13038 13039 9986de LeaveCriticalSection 13038->13039 13050 99874d 13038->13050 13039->13008 13055 986bb4 13042->13055 13045 99867b EnterCriticalSection LeaveCriticalSection 13046 998717 13045->13046 13047 998733 SetEvent ResetEvent 13046->13047 13048 998722 RtlWakeAllConditionVariable 13046->13048 13047->13006 13048->13006 13051 99875b SleepConditionVariableCS 13050->13051 13052 998774 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 13050->13052 13053 998798 13051->13053 13052->13053 13053->13038 13056 986bca 13055->13056 13057 986bc3 13055->13057 13064 98a5f5 13056->13064 13061 98a578 13057->13061 13060 98123e 13060->13045 13062 98a5f5 46 API calls 13061->13062 13063 98a58a 13062->13063 13063->13060 13067 98a341 13064->13067 13068 98a34d __FrameHandler3::FrameUnwindToState 13067->13068 13075 98f32d EnterCriticalSection 13068->13075 13070 98a35b 13076 98a39c 13070->13076 13072 98a368 13086 98a390 13072->13086 13075->13070 13077 98a3b7 13076->13077 13085 98a42a __dosmaperr 13076->13085 13084 98a40a 13077->13084 13077->13085 13089 9906f9 13077->13089 13078 9906f9 46 API calls 13081 98a420 13078->13081 13080 98a400 13082 98dd6e __freea 14 API calls 13080->13082 13083 98dd6e __freea 14 API calls 13081->13083 13082->13084 13083->13085 13084->13078 13084->13085 13085->13072 13117 98f375 LeaveCriticalSection 13086->13117 13088 98a379 13088->13060 13090 990721 13089->13090 13091 990706 13089->13091 13095 990730 13090->13095 13098 992cb5 13090->13098 13091->13090 13092 990712 13091->13092 13093 98dcfe __dosmaperr 14 API calls 13092->13093 13097 990717 __CreateFrameInfo 13093->13097 13105 992ce8 13095->13105 13097->13080 13099 992cc0 13098->13099 13100 992cd5 HeapSize 13098->13100 13101 98dcfe __dosmaperr 14 API calls 13099->13101 13100->13095 13102 992cc5 13101->13102 13103 98dc00 ___std_exception_copy 43 API calls 13102->13103 13104 992cd0 13103->13104 13104->13095 13106 992d00 13105->13106 13107 992cf5 13105->13107 13109 992d08 13106->13109 13115 992d11 __dosmaperr 13106->13115 13108 98fae8 15 API calls 13107->13108 13114 992cfd 13108->13114 13112 98dd6e __freea 14 API calls 13109->13112 13110 992d3b HeapReAlloc 13110->13114 13110->13115 13111 992d16 13113 98dcfe __dosmaperr 14 API calls 13111->13113 13112->13114 13113->13114 13114->13097 13115->13110 13115->13111 13116 990829 __dosmaperr EnterCriticalSection LeaveCriticalSection 13115->13116 13116->13115 13117->13088 13119 982e87 13118->13119 13120 98103b RaiseException 13119->13120 13121 982e8e 13119->13121 13122 982ea7 13120->13122 13121->13025 13123 982ec0 13122->13123 13124 982eb6 13122->13124 13126 982eca 13123->13126 13127 982f54 13123->13127 13125 982c62 44 API calls 13124->13125 13129 982ebb 13125->13129 13130 982c26 RaiseException 13126->13130 13128 98103b RaiseException 13127->13128 13131 982f5e 13128->13131 13129->13025 13132 982ee2 13130->13132 13133 982f3a 13132->13133 13134 982ef0 13132->13134 13135 983024 14 API calls 13133->13135 13136 982f01 13134->13136 13138 982f17 13134->13138 13140 982f11 __InternalCxxFrameHandler 13134->13140 13135->13140 13139 98dcfe __dosmaperr 14 API calls 13136->13139 13137 982e7d 44 API calls 13137->13129 13138->13140 13142 98dcfe __dosmaperr 14 API calls 13138->13142 13141 982f06 13139->13141 13140->13137 13143 98dc00 ___std_exception_copy 43 API calls 13141->13143 13142->13141 13143->13140 13145 982c74 13144->13145 13146 982c85 13144->13146 13145->13146 13147 982e7d 44 API calls 13145->13147 13146->13025 13147->13146 13149 99807f LeaveCriticalSection 13148->13149 13150 998076 13148->13150 13149->13034 13150->13149 13167 9828df 13150->13167 13154 9810f5 13153->13154 13155 9810d5 LockResource 13153->13155 13154->13034 13155->13154 13156 9810e2 SizeofResource 13155->13156 13156->13154 13158 982d97 13157->13158 13159 982d57 13157->13159 13158->13030 13160 9810bf 3 API calls 13159->13160 13161 982d64 13160->13161 13161->13158 13162 982c26 RaiseException 13161->13162 13163 982d77 13162->13163 13173 9998b7 13163->13173 13165 982d86 13166 982e7d 44 API calls 13165->13166 13166->13158 13168 9828e9 13167->13168 13170 9828ee 13168->13170 13172 981026 RaiseException 13168->13172 13170->13149 13171 982903 13172->13171 13174 9998c8 13173->13174 13183 9998c4 __InternalCxxFrameHandler 13173->13183 13175 9998cf 13174->13175 13176 9998e2 _wmemset 13174->13176 13177 98dcfe __dosmaperr 14 API calls 13175->13177 13180 99991c 13176->13180 13181 999913 13176->13181 13176->13183 13178 9998d4 13177->13178 13179 98dc00 ___std_exception_copy 43 API calls 13178->13179 13179->13183 13180->13183 13185 98dcfe __dosmaperr 14 API calls 13180->13185 13182 98dcfe __dosmaperr 14 API calls 13181->13182 13184 999918 13182->13184 13183->13165 13186 98dc00 ___std_exception_copy 43 API calls 13184->13186 13185->13184 13186->13183 13188 981952 13187->13188 13189 981ef7 13187->13189 13188->12809 13345 981fad 13188->13345 13190 982bff 59 API calls 13189->13190 13191 981f01 13190->13191 13192 982c26 RaiseException 13191->13192 13193 981f17 SHGetFolderPathW 13192->13193 13194 9828b9 44 API calls 13193->13194 13195 981f35 13194->13195 13196 981f9e 13195->13196 13197 982ba0 66 API calls 13195->13197 13198 982f5f RtlFreeHeap 13196->13198 13199 981f44 13197->13199 13198->13188 13406 982860 13199->13406 13202 981f6c 13204 982860 2 API calls 13202->13204 13203 981f5f GetLastError 13203->13202 13210 981f94 13203->13210 13206 981f79 13204->13206 13205 982f5f RtlFreeHeap 13205->13196 13413 981e34 CreateDirectoryW 13206->13413 13210->13205 13212 987760 __CreateFrameInfo 13211->13212 13213 982053 GetTempFileNameW 13212->13213 13214 982121 13213->13214 13215 982074 13213->13215 13216 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13214->13216 13217 982ba0 66 API calls 13215->13217 13218 981970 13216->13218 13219 982086 13217->13219 13218->12813 13232 982f7a 13218->13232 13432 98293d 13219->13432 13222 982f5f RtlFreeHeap 13223 9820a0 FindResourceW 13222->13223 13223->13214 13224 9820b4 LoadResource 13223->13224 13224->13214 13225 9820c1 LockResource 13224->13225 13225->13214 13226 9820ce CreateFileW 13225->13226 13226->13214 13227 9820ef SizeofResource 13226->13227 13440 982369 13227->13440 13230 982108 SetFilePointerEx 13230->13214 13231 982117 CloseHandle 13230->13231 13231->13214 13233 982f85 13232->13233 13234 982f93 13233->13234 13235 983024 14 API calls 13233->13235 13234->12818 13235->13234 13471 9984f0 13236->13471 13239 9835cf 13240 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13239->13240 13241 983777 13240->13241 13241->12818 13242 9835a5 13242->13239 13243 982f7a 14 API calls 13242->13243 13244 9835ff 13243->13244 13473 98377b 13244->13473 13247 98377b 69 API calls 13248 98362a CreateFileW 13247->13248 13249 983753 13248->13249 13250 983654 13248->13250 13251 982f5f RtlFreeHeap 13249->13251 13489 999ad4 13250->13489 13251->13239 13254 983691 13256 9836a8 ReadFile 13254->13256 13260 9836fe 13254->13260 13255 983706 FindCloseChangeNotification 13257 98371a 13255->13257 13258 983740 13255->13258 13256->13260 13261 9836c5 WriteFile 13256->13261 13262 98372e 13257->13262 13263 98293d 15 API calls 13257->13263 13258->13249 13259 983747 SetFilePointer 13258->13259 13259->13249 13260->13255 13261->13254 13261->13260 13262->13258 13495 9821ce 13262->13495 13263->13262 13266 982bff 59 API calls 13265->13266 13267 982145 13266->13267 13268 982c26 RaiseException 13267->13268 13269 98215c GetModuleFileNameW 13268->13269 13270 9828b9 44 API calls 13269->13270 13271 982174 13270->13271 13272 9821bf 13271->13272 13274 982ba0 66 API calls 13271->13274 13273 982f5f RtlFreeHeap 13272->13273 13275 9819f8 13273->13275 13276 98218b 13274->13276 13275->12819 13275->12825 13277 982860 2 API calls 13276->13277 13278 982198 CopyFileW 13277->13278 13279 9821a9 13278->13279 13280 9821b5 13278->13280 13281 98293d 15 API calls 13279->13281 13282 982f5f RtlFreeHeap 13280->13282 13281->13280 13282->13272 13284 9828c4 13283->13284 13285 982e7d 44 API calls 13284->13285 13286 9828dd 13285->13286 13286->12830 13288 98157a 13287->13288 13289 98157e 13287->13289 13288->12833 13617 98344a 13289->13617 13291 9818a2 13292 9834e2 3 API calls 13291->13292 13293 9818b3 13292->13293 13293->12833 13295 9815a4 13295->13291 13296 99879b 3 API calls 13295->13296 13297 981721 __InternalCxxFrameHandler 13295->13297 13296->13297 13627 9834e2 13297->13627 13299 982aaf 13298->13299 13300 982aba 13299->13300 13301 982acc 13299->13301 13302 982f7a 14 API calls 13300->13302 13303 982da5 58 API calls 13301->13303 13304 981b2c lstrcmpiW 13302->13304 13305 982ad3 13303->13305 13304->12858 13306 982e1c 44 API calls 13305->13306 13306->13304 13308 982bff 59 API calls 13307->13308 13309 981dc4 13308->13309 13310 9814eb 63 API calls 13309->13310 13311 981dd7 13310->13311 13312 982aa0 59 API calls 13311->13312 13313 981dee lstrcmpiW 13312->13313 13314 982f5f RtlFreeHeap 13313->13314 13315 981e01 13314->13315 13316 982c26 RaiseException 13315->13316 13321 981e1d 13315->13321 13317 981e15 13316->13317 13319 982e7d 44 API calls 13317->13319 13318 982f5f RtlFreeHeap 13320 981c3d 13318->13320 13319->13321 13320->12852 13320->12856 13321->13318 13323 982f7a 14 API calls 13322->13323 13324 9837f8 __CreateFrameInfo 13323->13324 13325 98380c GetStartupInfoW 13324->13325 13326 983843 CreateProcessW 13325->13326 13327 983835 13325->13327 13329 98386e WaitForSingleObject 13326->13329 13330 983861 GetLastError 13326->13330 13328 9830d0 15 API calls 13327->13328 13334 983840 13328->13334 13332 983880 GetExitCodeProcess 13329->13332 13333 983891 13329->13333 13331 9838a4 13330->13331 13336 982f5f RtlFreeHeap 13331->13336 13335 983894 CloseHandle CloseHandle 13332->13335 13333->13335 13334->13326 13335->13331 13337 9838ac 13336->13337 13337->12857 13339 98352c 13338->13339 13340 983543 13338->13340 13342 9828df RaiseException 13339->13342 13634 982904 13340->13634 13343 983535 DeleteFileW 13342->13343 13343->13339 13343->13340 13346 982bff 59 API calls 13345->13346 13347 981fc0 13346->13347 13348 982c26 RaiseException 13347->13348 13349 981fd7 GetTempPathW 13348->13349 13350 9828b9 44 API calls 13349->13350 13351 981fec 13350->13351 13352 98200f 13351->13352 13354 981e34 65 API calls 13351->13354 13353 982f5f RtlFreeHeap 13352->13353 13355 98201d 13353->13355 13356 981fff 13354->13356 13355->12809 13356->13352 13357 982aef 14 API calls 13356->13357 13357->13352 13359 982a69 13358->13359 13360 982a72 13359->13360 13361 982a84 13359->13361 13362 982f7a 14 API calls 13360->13362 13363 982da5 58 API calls 13361->13363 13365 981b6c 13362->13365 13364 982a8b 13363->13364 13366 982e1c 44 API calls 13364->13366 13367 99879b 13365->13367 13366->13365 13368 9987a4 ___std_exception_copy 13367->13368 13369 9987c3 13368->13369 13370 990829 __dosmaperr 2 API calls 13368->13370 13372 9987c5 13368->13372 13369->12875 13370->13368 13371 998856 13373 989616 std::_Xinvalid_argument RaiseException 13371->13373 13372->13371 13643 989616 13372->13643 13374 998873 13373->13374 13377 982bff 59 API calls 13376->13377 13378 9814fb 13377->13378 13379 982c26 RaiseException 13378->13379 13380 981514 13379->13380 13646 98cfd8 13380->13646 13383 9828b9 44 API calls 13384 981558 13383->13384 13385 982ca8 44 API calls 13384->13385 13386 981564 13385->13386 13387 982f5f RtlFreeHeap 13386->13387 13388 98156c 13387->13388 13390 982bff 59 API calls 13389->13390 13391 981d05 13390->13391 13392 9814eb 63 API calls 13391->13392 13393 981d1b 13392->13393 13394 982a5b 59 API calls 13393->13394 13395 981d36 13394->13395 13396 982f5f RtlFreeHeap 13395->13396 13397 981d4d __CreateFrameInfo 13396->13397 13399 981d63 GetModuleFileNameW 13397->13399 13405 981d95 13397->13405 13398 982f5f RtlFreeHeap 13400 981da3 13398->13400 13401 981d7f 13399->13401 13399->13405 13402 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13400->13402 13404 9814eb 63 API calls 13401->13404 13401->13405 13403 981db0 13402->13403 13403->12848 13404->13405 13405->13398 13407 982c26 RaiseException 13406->13407 13408 982871 PathAppendW 13407->13408 13410 982883 13408->13410 13409 981f51 CreateDirectoryW 13409->13202 13409->13203 13410->13409 13411 98103b RaiseException 13410->13411 13412 9828b8 13411->13412 13414 981e51 GetLastError 13413->13414 13415 981e62 13413->13415 13414->13415 13425 981e5e 13414->13425 13416 982bff 59 API calls 13415->13416 13417 981e6a 13416->13417 13418 982c26 RaiseException 13417->13418 13419 981e80 GetTempFileNameW 13418->13419 13420 9828b9 44 API calls 13419->13420 13422 981e9c 13420->13422 13421 981ecb 13423 982f5f RtlFreeHeap 13421->13423 13422->13421 13424 981ea5 DeleteFileW CreateDirectoryW 13422->13424 13423->13425 13424->13421 13426 981ebc 13424->13426 13425->13210 13428 982aef 13425->13428 13427 982aef 14 API calls 13426->13427 13427->13421 13429 982b07 13428->13429 13431 982b1b 13428->13431 13430 982f7a 14 API calls 13429->13430 13429->13431 13430->13431 13431->13210 13433 98295f 13432->13433 13434 98294f 13432->13434 13435 982f7a 14 API calls 13433->13435 13436 982095 13433->13436 13434->13433 13437 9829bf 13434->13437 13435->13436 13436->13222 13438 98103b RaiseException 13437->13438 13439 9829c9 13438->13439 13441 982399 13440->13441 13452 982391 13440->13452 13454 986440 13441->13454 13443 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13445 982103 13443->13445 13445->13230 13445->13231 13446 99879b 3 API calls 13447 982400 13446->13447 13448 99879b 3 API calls 13447->13448 13447->13452 13449 9824b8 13448->13449 13460 9864b6 13449->13460 13452->13443 13453 9824ff WriteFile 13453->13452 13455 986454 13454->13455 13456 9823c7 13455->13456 13464 9863ed 13455->13464 13456->13446 13463 98651a 13460->13463 13461 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13462 9824ed 13461->13462 13462->13452 13462->13453 13463->13461 13466 98640c 13464->13466 13465 986427 13465->13456 13468 98234d 13465->13468 13466->13465 13467 98234d 3 API calls 13466->13467 13467->13465 13469 99879b 3 API calls 13468->13469 13470 982358 13469->13470 13470->13456 13472 983562 ReadFile 13471->13472 13472->13239 13472->13242 13530 982da5 13473->13530 13476 98378d 13480 9837b4 13476->13480 13482 9837a6 13476->13482 13477 9837d7 13478 98103b RaiseException 13477->13478 13479 9837e1 13478->13479 13481 982dc4 46 API calls 13480->13481 13484 9837b2 13481->13484 13483 9829de 51 API calls 13482->13483 13483->13484 13534 982ca8 13484->13534 13487 982f5f RtlFreeHeap 13488 983618 13487->13488 13488->13247 13490 999ae7 ___std_exception_copy 13489->13490 13546 98d05a 13490->13546 13492 999b08 13493 98bce0 ___std_exception_copy 43 API calls 13492->13493 13494 983663 SetFilePointer 13493->13494 13494->13254 13494->13255 13496 982ba0 66 API calls 13495->13496 13497 9821e7 13496->13497 13498 98293d 15 API calls 13497->13498 13499 9821f3 13498->13499 13500 982271 13499->13500 13503 982228 13499->13503 13501 982f7a 14 API calls 13500->13501 13517 98226c 13501->13517 13502 982c26 RaiseException 13505 98228b 13502->13505 13504 9822c6 13503->13504 13508 982da5 58 API calls 13503->13508 13506 98103b RaiseException 13504->13506 13505->13504 13507 98229a CharLowerBuffW 13505->13507 13509 98233c 13506->13509 13510 982e7d 44 API calls 13507->13510 13511 98225e 13508->13511 13512 9821ce 67 API calls 13509->13512 13513 9822ab 13510->13513 13607 982e1c 13511->13607 13515 98234b 13512->13515 13513->13504 13516 98231b 13513->13516 13518 9822cd 13513->13518 13515->13258 13519 982f5f RtlFreeHeap 13516->13519 13517->13502 13522 982da5 58 API calls 13518->13522 13520 982323 13519->13520 13521 982f5f RtlFreeHeap 13520->13521 13523 98232b 13521->13523 13524 9822db 13522->13524 13523->13258 13525 982e1c 44 API calls 13524->13525 13526 9822e9 13525->13526 13527 982313 13526->13527 13529 982aef 14 API calls 13526->13529 13528 982f5f RtlFreeHeap 13527->13528 13528->13516 13529->13527 13531 982dae 13530->13531 13532 9811d5 58 API calls 13531->13532 13533 982dbc 13531->13533 13532->13533 13533->13476 13533->13477 13535 982d2b 13534->13535 13538 982cce 13534->13538 13536 98103b RaiseException 13535->13536 13537 982d35 13536->13537 13538->13535 13539 982cf4 13538->13539 13540 982c26 RaiseException 13539->13540 13541 982d01 13540->13541 13542 983024 14 API calls 13541->13542 13543 982d17 13542->13543 13544 982e7d 44 API calls 13543->13544 13545 982d24 13544->13545 13545->13487 13560 98cf1b 13546->13560 13548 98d06c 13549 98d081 13548->13549 13550 98d0b4 13548->13550 13559 98d09c 13548->13559 13551 98db83 ___std_exception_copy 29 API calls 13549->13551 13554 98d0d8 13550->13554 13567 98cec0 13550->13567 13551->13559 13556 98d0fc 13554->13556 13574 98d2a1 13554->13574 13555 98d184 13557 98ce69 43 API calls 13555->13557 13556->13555 13581 98ce69 13556->13581 13557->13559 13559->13492 13561 98cf20 13560->13561 13562 98cf33 13560->13562 13563 98dcfe __dosmaperr 14 API calls 13561->13563 13562->13548 13564 98cf25 13563->13564 13565 98dc00 ___std_exception_copy 43 API calls 13564->13565 13566 98cf30 13565->13566 13566->13548 13568 98bee0 ___std_exception_copy 43 API calls 13567->13568 13569 98ced0 13568->13569 13587 9914f9 13569->13587 13575 98d2ad 13574->13575 13576 98d2c3 13574->13576 13595 98fac4 13575->13595 13577 98d2d3 13576->13577 13600 992241 13576->13600 13577->13554 13579 98d2b8 13579->13554 13582 98ce7a 13581->13582 13583 98ce8e 13581->13583 13582->13583 13584 98dcfe __dosmaperr 14 API calls 13582->13584 13583->13555 13585 98ce83 13584->13585 13586 98dc00 ___std_exception_copy 43 API calls 13585->13586 13586->13583 13588 991510 13587->13588 13589 98ceed 13587->13589 13588->13589 13590 990200 ___scrt_uninitialize_crt 43 API calls 13588->13590 13591 991557 13589->13591 13590->13589 13592 99156e 13591->13592 13593 98cefa 13591->13593 13592->13593 13594 98edc5 ___scrt_uninitialize_crt 43 API calls 13592->13594 13593->13554 13594->13593 13596 98d6f0 _unexpected 43 API calls 13595->13596 13597 98facf 13596->13597 13598 9914cc 43 API calls 13597->13598 13599 98fadf 13598->13599 13599->13579 13601 98e408 43 API calls 13600->13601 13602 99225e 13601->13602 13603 98fe0e 46 API calls 13602->13603 13605 99226e 13602->13605 13603->13605 13604 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13606 99230a 13604->13606 13605->13604 13606->13577 13608 982e2a 13607->13608 13610 982e37 13607->13610 13608->13610 13612 982e3e 13608->13612 13609 98103b RaiseException 13611 982e77 13609->13611 13610->13609 13612->13611 13613 982e7d 44 API calls 13612->13613 13614 982e56 13613->13614 13615 983024 14 API calls 13614->13615 13616 982e63 13615->13616 13616->13517 13618 9834e2 3 API calls 13617->13618 13619 983459 CreateFileW 13618->13619 13620 9834c0 13619->13620 13621 98347c CreateFileMappingW 13619->13621 13620->13295 13622 983490 MapViewOfFile 13621->13622 13623 9834d3 13621->13623 13625 9834ca CloseHandle 13622->13625 13626 9834a5 VirtualQuery 13622->13626 13624 9834e2 3 API calls 13623->13624 13624->13620 13625->13623 13626->13620 13626->13625 13628 9834f8 13627->13628 13629 9834eb UnmapViewOfFile 13627->13629 13630 98350b 13628->13630 13631 9834fe CloseHandle 13628->13631 13629->13628 13632 98351e 13630->13632 13633 983511 CloseHandle 13630->13633 13631->13630 13632->13291 13633->13632 13635 982910 13634->13635 13636 982930 13634->13636 13637 982928 13635->13637 13638 982f5f RtlFreeHeap 13635->13638 13640 98a800 13637->13640 13638->13635 13641 98dd6e __freea 14 API calls 13640->13641 13642 98a818 13641->13642 13642->13636 13644 98965d RaiseException 13643->13644 13645 989630 13643->13645 13644->13371 13645->13644 13647 98cfec ___std_exception_copy 13646->13647 13652 98aa52 13647->13652 13650 98bce0 ___std_exception_copy 43 API calls 13651 98153a 13650->13651 13651->13383 13653 98aa7e 13652->13653 13654 98aaa1 13652->13654 13655 98db83 ___std_exception_copy 29 API calls 13653->13655 13654->13653 13658 98aaa9 13654->13658 13656 98aa96 13655->13656 13657 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13656->13657 13659 98abd3 13657->13659 13663 98c206 13658->13663 13659->13650 13676 98cf36 13663->13676 13666 98c229 13667 98db83 ___std_exception_copy 29 API calls 13666->13667 13668 98ab2a 13667->13668 13673 98bd1c 13668->13673 13669 98c253 13669->13668 13680 98bf3c 13669->13680 13683 98c446 13669->13683 13724 98c5d4 13669->13724 13674 98dd6e __freea 14 API calls 13673->13674 13675 98bd2c 13674->13675 13675->13656 13677 98c21b 13676->13677 13678 98cf41 13676->13678 13677->13666 13677->13668 13677->13669 13679 98db83 ___std_exception_copy 29 API calls 13678->13679 13679->13677 13760 98ae3d 13680->13760 13682 98bf79 13682->13669 13684 98c46c 13683->13684 13685 98c454 13683->13685 13686 98c4ad 13684->13686 13689 98db83 ___std_exception_copy 29 API calls 13684->13689 13685->13686 13687 98c66e 13685->13687 13688 98c5fe 13685->13688 13686->13669 13693 98c6c1 13687->13693 13694 98c673 13687->13694 13691 98c69b 13688->13691 13692 98c604 13688->13692 13690 98c4a1 13689->13690 13690->13669 13801 98b5ac 13691->13801 13699 98c64b 13692->13699 13702 98c60a 13692->13702 13706 98c640 13692->13706 13697 98c625 13693->13697 13698 98c6ca 13693->13698 13695 98c6b5 13694->13695 13696 98c675 13694->13696 13818 98cd8b 13695->13818 13700 98c6a9 13696->13700 13701 98c67a 13696->13701 13719 98c639 13697->13719 13776 98cda1 13697->13776 13698->13691 13698->13706 13699->13700 13709 98c655 13699->13709 13720 98c631 13699->13720 13808 98caa3 13700->13808 13701->13691 13707 98c67f 13701->13707 13702->13700 13702->13709 13712 98c617 13702->13712 13706->13719 13780 98b72e 13706->13780 13709->13719 13787 98cc43 13709->13787 13712->13697 13712->13700 13712->13719 13715 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13719->13715 13720->13719 13721 98cec0 ___scrt_uninitialize_crt 43 API calls 13720->13721 13723 98c8d7 13720->13723 13721->13723 13723->13719 13725 98c66e 13724->13725 13726 98c5fe 13724->13726 13729 98c6c1 13725->13729 13730 98c673 13725->13730 13727 98c69b 13726->13727 13728 98c604 13726->13728 13741 98b5ac 30 API calls 13727->13741 13735 98c64b 13728->13735 13739 98c60a 13728->13739 13740 98c640 13728->13740 13733 98c625 13729->13733 13734 98c6ca 13729->13734 13731 98c6b5 13730->13731 13732 98c675 13730->13732 13738 98cd8b 30 API calls 13731->13738 13736 98c6a9 13732->13736 13737 98c67a 13732->13737 13742 98cda1 43 API calls 13733->13742 13759 98c639 13733->13759 13734->13727 13734->13740 13735->13736 13744 98c655 13735->13744 13755 98c631 13735->13755 13745 98caa3 46 API calls 13736->13745 13737->13727 13743 98c67f 13737->13743 13738->13755 13739->13736 13739->13744 13749 98c617 13739->13749 13748 98b72e 30 API calls 13740->13748 13740->13759 13741->13755 13742->13755 13746 98c692 13743->13746 13747 98c684 13743->13747 13751 98cc43 44 API calls 13744->13751 13744->13759 13745->13755 13747->13759 13748->13755 13749->13733 13749->13736 13749->13759 13751->13755 13752 987182 __ehhandler$??_EGlobalCore@details@Concurrency@@QAEPAXI@Z 5 API calls 13754 98c9f3 13752->13754 13754->13669 13756 98cec0 ___scrt_uninitialize_crt 43 API calls 13755->13756 13758 98c8d7 13755->13758 13755->13759 13756->13758 13757 9920d2 ___scrt_uninitialize_crt 44 API calls 13757->13758 13758->13757 13758->13759 13759->13752 13761 98cf1b 43 API calls 13760->13761 13763 98ae53 13761->13763 13762 98ae68 13764 98db83 ___std_exception_copy 29 API calls 13762->13764 13763->13762 13766 98ae9b 13763->13766 13769 98ae83 13763->13769 13764->13769 13765 98b19a 13767 98ce92 43 API calls 13765->13767 13766->13765 13770 98ce92 13766->13770 13767->13769 13769->13682 13771 98cebc 13770->13771 13772 98cea7 13770->13772 13771->13765 13772->13771 13777 98cdbd 13776->13777 13781 98b742 13780->13781 13802 98b5c0 13801->13802 13803 98b5e2 13802->13803 13805 98b609 13802->13805 13819 98b72e 30 API calls 13818->13819 13938 982da5 58 API calls 13937->13938 13939 98325a 13938->13939 13940 9832a4 13939->13940 13943 9829de 51 API calls 13939->13943 13941 98103b RaiseException 13940->13941 13942 9832b5 GetLastError SetLastError FormatMessageW 13941->13942 13946 9832fb GetLastError 13942->13946 13947 983305 SetLastError 13942->13947 13945 983276 13943->13945 13945->13940 13951 983283 13945->13951 13946->13947 13948 9833c1 13946->13948 13949 9833aa 13947->13949 13950 983315 13947->13950 13952 982c62 44 API calls 13949->13952 13950->13949 13955 983326 13950->13955 13954 982f5f RtlFreeHeap 13951->13954 13953 9833b1 LocalFree 13952->13953 13953->12917 13957 9832a2 13954->13957 13956 982c26 RaiseException 13955->13956 13958 98333d 13956->13958 13957->12917 13959 98334b 13958->13959 13960 983393 13958->13960 13962 98335c 13959->13962 13966 983372 13959->13966 13968 98336c __InternalCxxFrameHandler 13959->13968 13961 983024 14 API calls 13960->13961 13961->13968 13964 98dcfe __dosmaperr 14 API calls 13962->13964 13963 982e7d 44 API calls 13965 9833a8 13963->13965 13967 983361 13964->13967 13965->13953 13966->13968 13969 98dcfe __dosmaperr 14 API calls 13966->13969 13970 98dc00 ___std_exception_copy 43 API calls 13967->13970 13968->13963 13969->13967 13970->13968 13972 989f8b 13971->13972 13973 989f9d 13971->13973 13974 986e57 __CreateFrameInfo GetModuleHandleW 13972->13974 13983 989e26 13973->13983 13976 989f90 13974->13976 13976->13973 13998 98a048 GetModuleHandleExW 13976->13998 13978 986992 13978->12242 13984 989e32 __FrameHandler3::FrameUnwindToState 13983->13984 14004 98f32d EnterCriticalSection 13984->14004 13986 989e3c 14005 989e73 13986->14005 13988 989e49 14009 989e67 13988->14009 13991 989ff5 14034 98a026 13991->14034 13994 98a013 13996 98a048 __CreateFrameInfo 3 API calls 13994->13996 13995 98a003 GetCurrentProcess TerminateProcess 13995->13994 13997 98a01b ExitProcess 13996->13997 13999 98a0a8 13998->13999 14000 98a087 GetProcAddress 13998->14000 14001 98a0ae FreeLibrary 13999->14001 14002 989f9c 13999->14002 14000->13999 14003 98a09b 14000->14003 14001->14002 14002->13973 14003->13999 14004->13986 14006 989e7f __FrameHandler3::FrameUnwindToState 14005->14006 14007 989ee6 __CreateFrameInfo 14006->14007 14012 98a58e 14006->14012 14007->13988 14033 98f375 LeaveCriticalSection 14009->14033 14011 989e55 14011->13978 14011->13991 14013 98a59a __EH_prolog3 14012->14013 14016 98a2e6 14013->14016 14015 98a5c1 __CreateFrameInfo 14015->14007 14017 98a2f2 __FrameHandler3::FrameUnwindToState 14016->14017 14024 98f32d EnterCriticalSection 14017->14024 14019 98a300 14025 98a49e 14019->14025 14024->14019 14026 98a30d 14025->14026 14027 98a4bd 14025->14027 14029 98a335 14026->14029 14027->14026 14028 98dd6e __freea 14 API calls 14027->14028 14028->14026 14032 98f375 LeaveCriticalSection 14029->14032 14031 98a31e 14031->14015 14032->14031 14033->14011 14039 98f38c GetPEB 14034->14039 14037 98a030 GetPEB 14038 989fff 14037->14038 14038->13994 14038->13995 14040 98a02b 14039->14040 14041 98f3a6 14039->14041 14040->14037 14040->14038 14043 99046d 14041->14043 14044 9903ea __dosmaperr 5 API calls 14043->14044 14045 990489 14044->14045 14045->14040 14047 98a752 ___scrt_uninitialize_crt 14046->14047 14048 98a740 14046->14048 14047->12236 14049 98a74e 14048->14049 14051 990e63 14048->14051 14049->12236 14054 990cf0 14051->14054 14057 990c44 14054->14057 14058 990c50 __FrameHandler3::FrameUnwindToState 14057->14058 14065 98f32d EnterCriticalSection 14058->14065 14060 990cc6 14074 990ce4 14060->14074 14062 990c5a ___scrt_uninitialize_crt 14062->14060 14066 990bb8 14062->14066 14065->14062 14067 990bc4 __FrameHandler3::FrameUnwindToState 14066->14067 14077 990f80 EnterCriticalSection 14067->14077 14069 990bce ___scrt_uninitialize_crt 14070 990c1a 14069->14070 14078 990dfe 14069->14078 14091 990c38 14070->14091 14193 98f375 LeaveCriticalSection 14074->14193 14076 990cd2 14076->14049 14077->14069 14079 990e13 ___std_exception_copy 14078->14079 14080 990e1a 14079->14080 14081 990e25 14079->14081 14082 990cf0 ___scrt_uninitialize_crt 72 API calls 14080->14082 14094 990d95 14081->14094 14084 990e20 14082->14084 14086 98bce0 ___std_exception_copy 43 API calls 14084->14086 14087 990e5d 14086->14087 14087->14070 14089 990e46 14107 992df3 14089->14107 14192 990f94 LeaveCriticalSection 14091->14192 14093 990c26 14093->14062 14095 990dae 14094->14095 14096 990dd5 14094->14096 14095->14096 14097 992205 ___scrt_uninitialize_crt 43 API calls 14095->14097 14096->14084 14100 992205 14096->14100 14098 990dca 14097->14098 14118 99361e 14098->14118 14101 992211 14100->14101 14102 992226 14100->14102 14103 98dcfe __dosmaperr 14 API calls 14101->14103 14102->14089 14104 992216 14103->14104 14105 98dc00 ___std_exception_copy 43 API calls 14104->14105 14106 992221 14105->14106 14106->14089 14108 992e04 14107->14108 14111 992e11 14107->14111 14109 98dcfe __dosmaperr 14 API calls 14108->14109 14113 992e09 14109->14113 14110 992e5a 14112 98dcfe __dosmaperr 14 API calls 14110->14112 14111->14110 14114 992e38 14111->14114 14115 992e5f 14112->14115 14113->14084 14159 992d51 14114->14159 14117 98dc00 ___std_exception_copy 43 API calls 14115->14117 14117->14113 14119 99362a __FrameHandler3::FrameUnwindToState 14118->14119 14120 9936ee 14119->14120 14122 993632 14119->14122 14123 99367f 14119->14123 14121 98db83 ___std_exception_copy 29 API calls 14120->14121 14121->14122 14122->14096 14129 98f50b EnterCriticalSection 14123->14129 14125 993685 14126 9936a2 14125->14126 14130 993726 14125->14130 14156 9936e6 14126->14156 14129->14125 14131 99374b 14130->14131 14154 99376e ___scrt_uninitialize_crt 14130->14154 14132 99374f 14131->14132 14134 9937ad 14131->14134 14133 98db83 ___std_exception_copy 29 API calls 14132->14133 14133->14154 14135 9937c4 14134->14135 14136 9958f4 ___scrt_uninitialize_crt 45 API calls 14134->14136 14137 9932aa ___scrt_uninitialize_crt 44 API calls 14135->14137 14136->14135 14138 9937ce 14137->14138 14139 993814 14138->14139 14140 9937d4 14138->14140 14143 993828 14139->14143 14144 993877 WriteFile 14139->14144 14141 9937db 14140->14141 14142 9937fe 14140->14142 14149 993242 ___scrt_uninitialize_crt 6 API calls 14141->14149 14141->14154 14145 992e70 ___scrt_uninitialize_crt 49 API calls 14142->14145 14147 993830 14143->14147 14148 993865 14143->14148 14146 993899 GetLastError 14144->14146 14144->14154 14145->14154 14146->14154 14151 993853 14147->14151 14152 993835 14147->14152 14150 993328 ___scrt_uninitialize_crt 7 API calls 14148->14150 14149->14154 14150->14154 14153 9934ec ___scrt_uninitialize_crt 8 API calls 14151->14153 14152->14154 14155 993403 ___scrt_uninitialize_crt 7 API calls 14152->14155 14153->14154 14154->14126 14155->14154 14157 98f52e ___scrt_uninitialize_crt LeaveCriticalSection 14156->14157 14158 9936ec 14157->14158 14158->14122 14160 992d5d __FrameHandler3::FrameUnwindToState 14159->14160 14172 98f50b EnterCriticalSection 14160->14172 14162 992d6c 14170 992db1 14162->14170 14173 98f5e2 14162->14173 14163 98dcfe __dosmaperr 14 API calls 14165 992db8 14163->14165 14189 992de7 14165->14189 14166 992d98 FlushFileBuffers 14166->14165 14167 992da4 GetLastError 14166->14167 14186 98dceb 14167->14186 14170->14163 14172->14162 14174 98f5ef 14173->14174 14175 98f604 14173->14175 14176 98dceb __dosmaperr 14 API calls 14174->14176 14177 98dceb __dosmaperr 14 API calls 14175->14177 14180 98f629 14175->14180 14178 98f5f4 14176->14178 14181 98f634 14177->14181 14179 98dcfe __dosmaperr 14 API calls 14178->14179 14182 98f5fc 14179->14182 14180->14166 14183 98dcfe __dosmaperr 14 API calls 14181->14183 14182->14166 14184 98f63c 14183->14184 14185 98dc00 ___std_exception_copy 43 API calls 14184->14185 14185->14182 14187 98d841 __dosmaperr 14 API calls 14186->14187 14188 98dcf0 14187->14188 14188->14170 14190 98f52e ___scrt_uninitialize_crt LeaveCriticalSection 14189->14190 14191 992dd0 14190->14191 14191->14113 14192->14093 14193->14076 14194 989b84 14195 98ed7d 53 API calls 14194->14195 14196 989b95 14195->14196 14209 98f24c GetEnvironmentStringsW 14196->14209 14199 989bac 14230 989bdd 14199->14230 14200 989ba0 14201 98dd6e __freea 14 API calls 14200->14201 14203 989ba6 14201->14203 14205 98dd6e __freea 14 API calls 14206 989bd0 14205->14206 14207 98dd6e __freea 14 API calls 14206->14207 14208 989bd6 14207->14208 14210 989b9a 14209->14210 14211 98f264 14209->14211 14210->14199 14210->14200 14212 98f15e ___scrt_uninitialize_crt WideCharToMultiByte 14211->14212 14213 98f281 14212->14213 14214 98f28b FreeEnvironmentStringsW 14213->14214 14215 98f296 14213->14215 14214->14210 14216 98fae8 15 API calls 14215->14216 14217 98f29d 14216->14217 14218 98f2a5 14217->14218 14219 98f2b6 14217->14219 14220 98dd6e __freea 14 API calls 14218->14220 14221 98f15e ___scrt_uninitialize_crt WideCharToMultiByte 14219->14221 14222 98f2aa FreeEnvironmentStringsW 14220->14222 14223 98f2c6 14221->14223 14222->14210 14224 98f2cd 14223->14224 14225 98f2d5 14223->14225 14227 98dd6e __freea 14 API calls 14224->14227 14226 98dd6e __freea 14 API calls 14225->14226 14228 98f2d3 FreeEnvironmentStringsW 14226->14228 14227->14228 14228->14210 14231 989bf2 14230->14231 14232 98dd11 __dosmaperr 14 API calls 14231->14232 14233 989c19 14232->14233 14234 989c21 14233->14234 14243 989c2b 14233->14243 14235 98dd6e __freea 14 API calls 14234->14235 14251 989bb3 14235->14251 14236 989c88 14237 98dd6e __freea 14 API calls 14236->14237 14237->14251 14238 98dd11 __dosmaperr 14 API calls 14238->14243 14239 989c97 14261 989cbf 14239->14261 14243->14236 14243->14238 14243->14239 14245 989cb2 14243->14245 14247 98dd6e __freea 14 API calls 14243->14247 14252 98a826 14243->14252 14244 98dd6e __freea 14 API calls 14246 989ca4 14244->14246 14248 98dc2d ___std_exception_copy 11 API calls 14245->14248 14249 98dd6e __freea 14 API calls 14246->14249 14247->14243 14250 989cbe 14248->14250 14249->14251 14251->14205 14253 98a834 14252->14253 14254 98a842 14252->14254 14253->14254 14259 98a85a 14253->14259 14255 98dcfe __dosmaperr 14 API calls 14254->14255 14256 98a84a 14255->14256 14257 98dc00 ___std_exception_copy 43 API calls 14256->14257 14258 98a854 14257->14258 14258->14243 14259->14258 14260 98dcfe __dosmaperr 14 API calls 14259->14260 14260->14256 14262 989c9d 14261->14262 14263 989ccc 14261->14263 14262->14244 14264 989ce3 14263->14264 14265 98dd6e __freea 14 API calls 14263->14265 14266 98dd6e __freea 14 API calls 14264->14266 14265->14263 14266->14262 15099 990f34 15100 990e63 ___scrt_uninitialize_crt 72 API calls 15099->15100 15101 990f3c 15100->15101 15109 993926 15101->15109 15103 990f41 15119 9939d1 15103->15119 15106 990f6b 15107 98dd6e __freea 14 API calls 15106->15107 15108 990f76 15107->15108 15110 993932 __FrameHandler3::FrameUnwindToState 15109->15110 15123 98f32d EnterCriticalSection 15110->15123 15112 9939a9 15130 9939c8 15112->15130 15114 99393d 15114->15112 15116 99397d DeleteCriticalSection 15114->15116 15124 995a69 15114->15124 15118 98dd6e __freea 14 API calls 15116->15118 15118->15114 15120 9939e8 15119->15120 15122 990f50 DeleteCriticalSection 15119->15122 15121 98dd6e __freea 14 API calls 15120->15121 15120->15122 15121->15122 15122->15103 15122->15106 15123->15114 15125 995a7c ___std_exception_copy 15124->15125 15133 995944 15125->15133 15127 995a88 15128 98bce0 ___std_exception_copy 43 API calls 15127->15128 15129 995a94 15128->15129 15129->15114 15205 98f375 LeaveCriticalSection 15130->15205 15132 9939b5 15132->15103 15134 995950 __FrameHandler3::FrameUnwindToState 15133->15134 15135 99595a 15134->15135 15136 99597d 15134->15136 15137 98db83 ___std_exception_copy 29 API calls 15135->15137 15139 995975 15136->15139 15144 990f80 EnterCriticalSection 15136->15144 15137->15139 15139->15127 15140 99599b 15145 9959db 15140->15145 15142 9959a8 15159 9959d3 15142->15159 15144->15140 15146 9959e8 15145->15146 15147 995a0b 15145->15147 15148 98db83 ___std_exception_copy 29 API calls 15146->15148 15149 995a03 15147->15149 15150 990d95 ___scrt_uninitialize_crt 68 API calls 15147->15150 15148->15149 15149->15142 15151 995a23 15150->15151 15152 9939d1 14 API calls 15151->15152 15153 995a2b 15152->15153 15154 992205 ___scrt_uninitialize_crt 43 API calls 15153->15154 15155 995a37 15154->15155 15162 99669c 15155->15162 15158 98dd6e __freea 14 API calls 15158->15149 15204 990f94 LeaveCriticalSection 15159->15204 15161 9959d9 15161->15139 15163 995a3e 15162->15163 15164 9966c5 15162->15164 15163->15149 15163->15158 15165 996714 15164->15165 15167 9966ec 15164->15167 15166 98db83 ___std_exception_copy 29 API calls 15165->15166 15166->15163 15169 99660b 15167->15169 15170 996617 __FrameHandler3::FrameUnwindToState 15169->15170 15177 98f50b EnterCriticalSection 15170->15177 15172 996625 15173 996656 15172->15173 15178 99673f 15172->15178 15191 996690 15173->15191 15177->15172 15179 98f5e2 ___scrt_uninitialize_crt 43 API calls 15178->15179 15181 99674f 15179->15181 15180 996755 15194 98f551 15180->15194 15181->15180 15182 996787 15181->15182 15184 98f5e2 ___scrt_uninitialize_crt 43 API calls 15181->15184 15182->15180 15185 98f5e2 ___scrt_uninitialize_crt 43 API calls 15182->15185 15186 99677e 15184->15186 15187 996793 CloseHandle 15185->15187 15188 98f5e2 ___scrt_uninitialize_crt 43 API calls 15186->15188 15187->15180 15189 99679f GetLastError 15187->15189 15188->15182 15189->15180 15190 9967ad ___scrt_uninitialize_crt 15190->15173 15203 98f52e LeaveCriticalSection 15191->15203 15193 996679 15193->15163 15195 98f560 15194->15195 15196 98f5c7 15194->15196 15195->15196 15202 98f58a 15195->15202 15197 98dcfe __dosmaperr 14 API calls 15196->15197 15198 98f5cc 15197->15198 15199 98dceb __dosmaperr 14 API calls 15198->15199 15200 98f5b7 15199->15200 15200->15190 15201 98f5b1 SetStdHandle 15201->15200 15202->15200 15202->15201 15203->15193 15204->15161 15205->15132 14663 98d5b7 14664 98d5c2 14663->14664 14668 98d5d2 14663->14668 14669 98d5d8 14664->14669 14667 98dd6e __freea 14 API calls 14667->14668 14670 98d5ed 14669->14670 14671 98d5f3 14669->14671 14672 98dd6e __freea 14 API calls 14670->14672 14673 98dd6e __freea 14 API calls 14671->14673 14672->14671 14674 98d5ff 14673->14674 14675 98dd6e __freea 14 API calls 14674->14675 14676 98d60a 14675->14676 14677 98dd6e __freea 14 API calls 14676->14677 14678 98d615 14677->14678 14679 98dd6e __freea 14 API calls 14678->14679 14680 98d620 14679->14680 14681 98dd6e __freea 14 API calls 14680->14681 14682 98d62b 14681->14682 14683 98dd6e __freea 14 API calls 14682->14683 14684 98d636 14683->14684 14685 98dd6e __freea 14 API calls 14684->14685 14686 98d641 14685->14686 14687 98dd6e __freea 14 API calls 14686->14687 14688 98d64c 14687->14688 14689 98dd6e __freea 14 API calls 14688->14689 14690 98d65a 14689->14690 14695 98d404 14690->14695 14696 98d410 __FrameHandler3::FrameUnwindToState 14695->14696 14711 98f32d EnterCriticalSection 14696->14711 14698 98d444 14712 98d463 14698->14712 14701 98d41a 14701->14698 14702 98dd6e __freea 14 API calls 14701->14702 14702->14698 14703 98d46f 14704 98d47b __FrameHandler3::FrameUnwindToState 14703->14704 14716 98f32d EnterCriticalSection 14704->14716 14706 98d485 14707 98d6a5 __dosmaperr 14 API calls 14706->14707 14708 98d498 14707->14708 14717 98d4b8 14708->14717 14711->14701 14715 98f375 LeaveCriticalSection 14712->14715 14714 98d451 14714->14703 14715->14714 14716->14706 14720 98f375 LeaveCriticalSection 14717->14720 14719 98d4a6 14719->14667 14720->14719 15229 98a221 15232 98a186 15229->15232 15233 98a192 __FrameHandler3::FrameUnwindToState 15232->15233 15240 98f32d EnterCriticalSection 15233->15240 15235 98a1ca 15241 98a1e8 15235->15241 15236 98a19c 15236->15235 15238 990281 ___scrt_uninitialize_crt 14 API calls 15236->15238 15238->15236 15240->15236 15244 98f375 LeaveCriticalSection 15241->15244 15243 98a1d6 15244->15243 14267 986954 14268 986e57 __CreateFrameInfo GetModuleHandleW 14267->14268 14269 98695c 14268->14269 14270 986960 14269->14270 14271 986992 14269->14271 14272 98696b 14270->14272 14276 98a0d9 14270->14276 14273 98a0f7 __CreateFrameInfo 23 API calls 14271->14273 14275 98699a 14273->14275 14277 989f5e __CreateFrameInfo 23 API calls 14276->14277 14278 98a0e4 14277->14278 14278->14272 14862 98f7c8 14863 98f7d4 __FrameHandler3::FrameUnwindToState 14862->14863 14874 98f32d EnterCriticalSection 14863->14874 14865 98f7db 14875 98f46d 14865->14875 14873 98f7f9 14899 98f81f 14873->14899 14874->14865 14876 98f479 __FrameHandler3::FrameUnwindToState 14875->14876 14877 98f482 14876->14877 14878 98f4a3 14876->14878 14879 98dcfe __dosmaperr 14 API calls 14877->14879 14902 98f32d EnterCriticalSection 14878->14902 14881 98f487 14879->14881 14882 98dc00 ___std_exception_copy 43 API calls 14881->14882 14884 98f491 14882->14884 14883 98f4db 14910 98f502 14883->14910 14884->14873 14888 98f662 GetStartupInfoW 14884->14888 14885 98f4af 14885->14883 14903 98f3bd 14885->14903 14889 98f67f 14888->14889 14890 98f713 14888->14890 14889->14890 14891 98f46d 44 API calls 14889->14891 14894 98f718 14890->14894 14892 98f6a7 14891->14892 14892->14890 14893 98f6d7 GetFileType 14892->14893 14893->14892 14896 98f71f 14894->14896 14895 98f762 GetStdHandle 14895->14896 14896->14895 14897 98f7c4 14896->14897 14898 98f775 GetFileType 14896->14898 14897->14873 14898->14896 14919 98f375 LeaveCriticalSection 14899->14919 14901 98f80a 14902->14885 14904 98dd11 __dosmaperr 14 API calls 14903->14904 14905 98f3cf 14904->14905 14909 98f3dc 14905->14909 14913 9905cb 14905->14913 14906 98dd6e __freea 14 API calls 14908 98f431 14906->14908 14908->14885 14909->14906 14918 98f375 LeaveCriticalSection 14910->14918 14912 98f509 14912->14884 14914 9903ea __dosmaperr 5 API calls 14913->14914 14915 9905e7 14914->14915 14916 990605 InitializeCriticalSectionAndSpinCount 14915->14916 14917 9905f0 14915->14917 14916->14917 14917->14905 14918->14912 14919->14901 11884 982fcd 11885 982fde 11884->11885 11886 982fe7 11885->11886 11889 982ff1 11885->11889 11891 9830d0 11886->11891 11888 982fef 11889->11888 11898 983098 11889->11898 11892 9830ef 11891->11892 11902 9812ad 11892->11902 11894 983144 11896 98311b 11896->11888 11899 9830bb 11898->11899 11900 9830ac 11898->11900 11899->11888 11900->11899 12133 98131f 11900->12133 11903 9812f2 11902->11903 11904 9812bb 11902->11904 11903->11894 11906 983024 11903->11906 11904->11903 11912 981138 RtlAllocateHeap 11904->11912 11907 983036 11906->11907 11910 983059 __InternalCxxFrameHandler 11906->11910 11908 98303f __CreateFrameInfo 11907->11908 11913 98dcfe 11907->11913 11908->11910 11911 98dcfe 14 API calls __dosmaperr 11908->11911 11910->11896 11911->11908 11912->11903 11916 98d841 GetLastError 11913->11916 11915 98dd03 11915->11908 11917 98d85d 11916->11917 11918 98d857 11916->11918 11922 98d861 SetLastError 11917->11922 11944 990589 11917->11944 11939 99054a 11918->11939 11922->11915 11925 98d88e 11926 98d896 11925->11926 11927 98d8a7 11925->11927 11929 990589 __dosmaperr 6 API calls 11926->11929 11928 990589 __dosmaperr 6 API calls 11927->11928 11930 98d8b3 11928->11930 11931 98d8a4 11929->11931 11932 98d8ce 11930->11932 11933 98d8b7 11930->11933 11956 98dd6e 11931->11956 11962 98d51e 11932->11962 11934 990589 __dosmaperr 6 API calls 11933->11934 11934->11931 11938 98dd6e __freea 12 API calls 11938->11922 11967 9903ea 11939->11967 11941 990566 11942 99056f 11941->11942 11943 990581 TlsGetValue 11941->11943 11942->11917 11945 9903ea __dosmaperr 5 API calls 11944->11945 11946 9905a5 11945->11946 11947 98d879 11946->11947 11948 9905c3 TlsSetValue 11946->11948 11947->11922 11949 98dd11 11947->11949 11954 98dd1e __dosmaperr 11949->11954 11950 98dd5e 11953 98dcfe __dosmaperr 13 API calls 11950->11953 11951 98dd49 HeapAlloc 11952 98dd5c 11951->11952 11951->11954 11952->11925 11953->11952 11954->11950 11954->11951 11981 990829 11954->11981 11957 98dd79 RtlFreeHeap 11956->11957 11958 98dda3 11956->11958 11957->11958 11959 98dd8e GetLastError 11957->11959 11958->11922 11960 98dd9b __dosmaperr 11959->11960 11961 98dcfe __dosmaperr 12 API calls 11960->11961 11961->11958 11995 98d3b2 11962->11995 11968 990418 11967->11968 11972 990414 __dosmaperr 11967->11972 11968->11972 11973 99031f 11968->11973 11971 990432 GetProcAddress 11971->11972 11972->11941 11979 990330 11973->11979 11974 9903c6 11974->11971 11974->11972 11975 99034e LoadLibraryExW 11976 990369 GetLastError 11975->11976 11977 9903cd 11975->11977 11976->11979 11977->11974 11978 9903df FreeLibrary 11977->11978 11978->11974 11979->11974 11979->11975 11980 99039c LoadLibraryExW 11979->11980 11980->11977 11980->11979 11984 990856 11981->11984 11985 990862 __FrameHandler3::FrameUnwindToState 11984->11985 11990 98f32d EnterCriticalSection 11985->11990 11987 99086d 11991 9908a9 11987->11991 11990->11987 11994 98f375 LeaveCriticalSection 11991->11994 11993 990834 11993->11954 11994->11993 11996 98d3be __FrameHandler3::FrameUnwindToState 11995->11996 12009 98f32d EnterCriticalSection 11996->12009 11998 98d3c8 12010 98d3f8 11998->12010 12001 98d4c4 12002 98d4d0 __FrameHandler3::FrameUnwindToState 12001->12002 12014 98f32d EnterCriticalSection 12002->12014 12004 98d4da 12015 98d6a5 12004->12015 12006 98d4f2 12019 98d512 12006->12019 12009->11998 12013 98f375 LeaveCriticalSection 12010->12013 12012 98d3e6 12012->12001 12013->12012 12014->12004 12016 98d6b4 __dosmaperr 12015->12016 12018 98d6db __dosmaperr 12015->12018 12016->12018 12022 98ffb4 12016->12022 12018->12006 12132 98f375 LeaveCriticalSection 12019->12132 12021 98d500 12021->11938 12023 990034 12022->12023 12025 98ffca 12022->12025 12026 98dd6e __freea 14 API calls 12023->12026 12048 990082 12023->12048 12025->12023 12030 98dd6e __freea 14 API calls 12025->12030 12032 98fffd 12025->12032 12027 990056 12026->12027 12028 98dd6e __freea 14 API calls 12027->12028 12033 990069 12028->12033 12029 98dd6e __freea 14 API calls 12034 990029 12029->12034 12036 98fff2 12030->12036 12031 990090 12035 9900f0 12031->12035 12049 98dd6e 14 API calls __freea 12031->12049 12037 98dd6e __freea 14 API calls 12032->12037 12047 99001f 12032->12047 12038 98dd6e __freea 14 API calls 12033->12038 12041 98dd6e __freea 14 API calls 12034->12041 12042 98dd6e __freea 14 API calls 12035->12042 12050 98f854 12036->12050 12039 990014 12037->12039 12040 990077 12038->12040 12078 98f952 12039->12078 12045 98dd6e __freea 14 API calls 12040->12045 12041->12023 12046 9900f6 12042->12046 12045->12048 12046->12018 12047->12029 12090 990125 12048->12090 12049->12031 12051 98f865 12050->12051 12077 98f94e 12050->12077 12052 98f876 12051->12052 12054 98dd6e __freea 14 API calls 12051->12054 12053 98f888 12052->12053 12055 98dd6e __freea 14 API calls 12052->12055 12056 98f89a 12053->12056 12057 98dd6e __freea 14 API calls 12053->12057 12054->12052 12055->12053 12058 98f8ac 12056->12058 12059 98dd6e __freea 14 API calls 12056->12059 12057->12056 12060 98f8be 12058->12060 12062 98dd6e __freea 14 API calls 12058->12062 12059->12058 12061 98f8d0 12060->12061 12063 98dd6e __freea 14 API calls 12060->12063 12064 98f8e2 12061->12064 12065 98dd6e __freea 14 API calls 12061->12065 12062->12060 12063->12061 12066 98f8f4 12064->12066 12067 98dd6e __freea 14 API calls 12064->12067 12065->12064 12068 98f906 12066->12068 12070 98dd6e __freea 14 API calls 12066->12070 12067->12066 12069 98f918 12068->12069 12071 98dd6e __freea 14 API calls 12068->12071 12072 98dd6e __freea 14 API calls 12069->12072 12074 98f92a 12069->12074 12070->12068 12071->12069 12072->12074 12073 98f93c 12076 98dd6e __freea 14 API calls 12073->12076 12073->12077 12074->12073 12075 98dd6e __freea 14 API calls 12074->12075 12075->12073 12076->12077 12077->12032 12079 98f95f 12078->12079 12089 98f9b7 12078->12089 12080 98dd6e __freea 14 API calls 12079->12080 12081 98f96f 12079->12081 12080->12081 12082 98f981 12081->12082 12084 98dd6e __freea 14 API calls 12081->12084 12083 98f993 12082->12083 12085 98dd6e __freea 14 API calls 12082->12085 12086 98f9a5 12083->12086 12087 98dd6e __freea 14 API calls 12083->12087 12084->12082 12085->12083 12088 98dd6e __freea 14 API calls 12086->12088 12086->12089 12087->12086 12088->12089 12089->12047 12091 990151 12090->12091 12092 990132 12090->12092 12091->12031 12092->12091 12096 98f9e0 12092->12096 12095 98dd6e __freea 14 API calls 12095->12091 12097 98f9f1 12096->12097 12131 98fabe 12096->12131 12098 98f9bb __dosmaperr 14 API calls 12097->12098 12099 98f9f9 12098->12099 12100 98f9bb __dosmaperr 14 API calls 12099->12100 12101 98fa04 12100->12101 12102 98f9bb __dosmaperr 14 API calls 12101->12102 12103 98fa0f 12102->12103 12104 98f9bb __dosmaperr 14 API calls 12103->12104 12105 98fa1a 12104->12105 12106 98f9bb __dosmaperr 14 API calls 12105->12106 12107 98fa28 12106->12107 12108 98dd6e __freea 14 API calls 12107->12108 12109 98fa33 12108->12109 12110 98dd6e __freea 14 API calls 12109->12110 12111 98fa3e 12110->12111 12112 98dd6e __freea 14 API calls 12111->12112 12113 98fa49 12112->12113 12114 98f9bb __dosmaperr 14 API calls 12113->12114 12115 98fa57 12114->12115 12116 98f9bb __dosmaperr 14 API calls 12115->12116 12117 98fa65 12116->12117 12118 98f9bb __dosmaperr 14 API calls 12117->12118 12119 98fa76 12118->12119 12120 98f9bb __dosmaperr 14 API calls 12119->12120 12121 98fa84 12120->12121 12122 98f9bb __dosmaperr 14 API calls 12121->12122 12123 98fa92 12122->12123 12124 98dd6e __freea 14 API calls 12123->12124 12125 98fa9d 12124->12125 12126 98dd6e __freea 14 API calls 12125->12126 12127 98faa8 12126->12127 12128 98dd6e __freea 14 API calls 12127->12128 12129 98fab3 12128->12129 12130 98dd6e __freea 14 API calls 12129->12130 12130->12131 12131->12095 12132->12021 12134 98132a 12133->12134 12135 981365 12133->12135 12134->12135 12137 981168 12134->12137 12135->11899 12138 98117b 12137->12138 12140 981172 12137->12140 12139 98118b RtlReAllocateHeap 12138->12139 12138->12140 12139->12140 12140->12135

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00982024 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetTempFileNameW.KERNELBASE(?,GUT,00000000,?), ref: 00982066
                                                                                                                                                                                                      • FindResourceW.KERNEL32(00000000,00000066,0099FB3C,?,?), ref: 009820A8
                                                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000), ref: 009820B7
                                                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 009820C2
                                                                                                                                                                                                      • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000000,00000000), ref: 009820E2
                                                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000,00000000), ref: 009820F4
                                                                                                                                                                                                      • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 0098210D
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00982118
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Resource$File$CloseCreateFindHandleLoadLockNamePointerSizeofTemp
                                                                                                                                                                                                      • String ID: GUT
                                                                                                                                                                                                      • API String ID: 3559219628-559840939
                                                                                                                                                                                                      • Opcode ID: d288b7b4566d6a08128bd5d587a9f3131fdc842bfc58efbd343b50f84b88485e
                                                                                                                                                                                                      • Instruction ID: ac19953bcf411de55a3843dbc639f7cefe17e15af2aae7a9f3a059620be6f98e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d288b7b4566d6a08128bd5d587a9f3131fdc842bfc58efbd343b50f84b88485e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8A21A2716082197FD720FBB89C8DFBBB3ACEB45358F100566BA15D22D1EA708D4487A1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098277B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 0098278F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 00982796
                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000006), ref: 009827AC
                                                                                                                                                                                                        • Part of subcall function 00982604: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00982660
                                                                                                                                                                                                        • Part of subcall function 00982604: RegCreateKeyExW.KERNELBASE(80000001,Software\BraveSoftware\Promo,?,?,?,00020006,?,?,?), ref: 0098268F
                                                                                                                                                                                                        • Part of subcall function 00982604: lstrlenW.KERNEL32(?), ref: 009826A0
                                                                                                                                                                                                        • Part of subcall function 00982604: RegSetValueExW.KERNELBASE(?,StubInstallerPath,?,00000001,?,00000000), ref: 009826C3
                                                                                                                                                                                                        • Part of subcall function 00982604: RegCloseKey.ADVAPI32(?), ref: 009826D3
                                                                                                                                                                                                        • Part of subcall function 009826E9: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00982725
                                                                                                                                                                                                        • Part of subcall function 009818B8: DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00982845,?,?), ref: 009818DA
                                                                                                                                                                                                        • Part of subcall function 009818B8: RemoveDirectoryW.KERNELBASE(?,?,00000000,?,00982845,?,?), ref: 009818F2
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileModule$Name$AddressCloseCreateDeleteDirectoryHandleInitializeProcRemoveValuelstrlen
                                                                                                                                                                                                      • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                                      • API String ID: 3408119680-2102062458
                                                                                                                                                                                                      • Opcode ID: fa89b7f25c53332ded24ecb719aecc9b17f4ca7fd9f49e3e6299046c780d65a2
                                                                                                                                                                                                      • Instruction ID: 45048e23439d0bdda332a4a2c465ee9035b01e5c9f927a9810ef8c3226a77ce7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fa89b7f25c53332ded24ecb719aecc9b17f4ca7fd9f49e3e6299046c780d65a2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6219F319193029BC700FF74C862A5EBBA8AF95754F00492DF886932E1EF30DA05CB92
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00983B7C Relevance: 415.5, APIs: 1, Strings: 236, Instructions: 798COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __Init_thread_footer.LIBCMT ref: 00984AF5
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Init_thread_footer
                                                                                                                                                                                                      • String ID: AAV730$ABO677$AMV588$ANM246$APG060$APN295$APV192$ARO656$ASY224$BEM856$BHD893$BNI512$BOA207$BSB375$BSC752$BTZ601$BUE553$BWC385$BXN418$BXV384$BYJ598$CBW249$CCJ078$CCQ716$CCU246$CEL792$CFT923$CHY006$CJO449$CSY475$CTD238$CVB741$CZQ141$DFG223$DFQ107$DHU083$DKD200$DLQ981$DPM796$DPX255$DRR783$DSE071$DSL157$DVZ178$DWC715$DZF201$EBC998$EDE311$EHH775$EKB849$EPH628$ERQ913$ERW274$ERX748$ESP177$EZM037$EZM787$FBI093$FBW502$FEB604$FEX878$FFL997$FQW627$FST304$FUX638$GFQ506$GMM900$GMV203$GTW616$HFS553$HLK526$HQK918$HQL833$HXM441$HYJ986$IBU843$IFN767$IJZ122$ILY758$IOB292$IOJ320$IQC112$ITO318$IUX155$IXQ557$IXX292$JDT909$JJE625$JQP631$JRN526$JWA535$JYK534$KBJ557$KJD945$KJP000$KSU863$KVC600$KWZ833$KXC376$KYW570$LDD929$LIR950$LJT611$LRT088$LSS305$LWP706$LYD303$MEB961$MGD911$MJM666$MMT745$MOU235$MPO928$MQP631$MSG315$MTB027$MTS962$MZJ289$MZX864$NFF966$NGU383$NGY511$NHX686$NKZ324$NOQ491$NRX711$NUB585$NWN118$OCA003$OIE359$OIL401$OIQ043$OJV851$OLS686$OOB354$OOJ613$OOX752$OPV062$ORX404$OSB729$OVK455$OXU789$OZC828$OZD582$PJJ948$PNE044$PPD370$PRI875$PSN487$PZH825$QAA606$QFE427$QJQ727$QLM391$QPE677$QXS120$RBW016$RDS304$RHI430$RMB905$RMB962$RNH069$RPW794$RQH046$RZD797$SBW951$SFM009$SIV168$SLY677$SOB084$SOB703$TBD002$TJF413$TJK021$TNW414$TOT965$TQD211$TRR894$TSM531$TVJ301$TZS401$UEO521$UGI415$UGO473$UIH408$UNK157$UNQ913$UPF883$UPQ934$UQN934$UQS362$UTD029$UUD854$VBC538$VBQ225$VGT997$VIW485$VNI569$VWK786$VZF120$WGN943$WIR635$WIV076$WIX525$WKG906$WLJ467$XER314$XMW172$XMZ986$XOB016$XOX898$XPM257$XPO114$XTA152$YAB346$YBX790$YDQ106$YHC941$YHS197$YIZ978$YPH104$YQI537$YXG330$YXT225$YZR853$YZV909$ZGL739$ZIQ953$ZJN514$ZMC689$ZQM087$ZTT758$ZVI549$ZWR105$ZWV410$ZYB215
                                                                                                                                                                                                      • API String ID: 1385522511-319640288
                                                                                                                                                                                                      • Opcode ID: 1356ce33bab4773efb372dd1fc506902ce40d1e82ed820b61c48888345ebb965
                                                                                                                                                                                                      • Instruction ID: de232571a685631328f99fe5cc97d86b7491d60a4f4dad4621d2cd864160db0f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1356ce33bab4773efb372dd1fc506902ce40d1e82ed820b61c48888345ebb965
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76722A309932149EDB94FB50CD67FDCB3B4ABD6704F9049A8B04AB21A19F707B46CB94
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00981935 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 245stringCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 504 981935-981954 call 981edd 507 981969-98197d call 982024 504->507 508 981956-98195f call 981fad 504->508 514 981cce 507->514 515 981983-9819c8 call 982f7a 507->515 508->507 513 981961-981964 508->513 516 981cd0-981cde call 987182 513->516 514->516 521 9819ce-9819e2 call 983555 515->521 524 9819e8-9819ef 521->524 525 981cbc-981cc2 call 983520 521->525 524->521 526 9819f1-9819fa call 982132 524->526 529 981cc7-981cc8 CloseHandle 525->529 526->525 531 981a00-981a12 526->531 529->514 531->525 532 981a18-981a88 call 982f7a call 982c26 PathQuoteSpacesW call 9828b9 call 987760 GetModuleFileNameW 531->532 541 981a8a-981a8c 532->541 542 981aa3-981aa5 532->542 541->542 544 981a8e-981a94 call 981570 541->544 543 981aab-981ab4 542->543 545 981aba-981abc 543->545 546 981c0e-981c2c call 9814eb call 981cdf 543->546 548 981a99-981aa1 544->548 549 981ada-981b3d call 982b50 call 982bff call 983155 call 982aa0 lstrcmpiW call 982f5f 545->549 550 981abe-981ad5 call 98254e call 982f5f 545->550 560 981c31-981c3f call 981db4 546->560 548->543 580 981b42-981b44 549->580 550->525 566 981c8d-981c9d call 9837e2 560->566 567 981c41-981c43 560->567 574 981ca2-981ca6 566->574 567->566 570 981c45-981c88 call 982b50 call 9831c7 call 9814eb call 982f5f 567->570 570->566 577 981ca8-981cae call 9985b1 574->577 578 981caf-981cba call 982f5f 574->578 577->578 578->525 584 981b4a-981bcb call 982a5b call 99879b call 9999b0 call 9985b1 call 9814eb call 982f5f 580->584 585 981bcd-981bed call 9814eb 580->585 594 981bf0-981c0c call 982f5f * 2 584->594 585->594 594->560
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00981EDD: IsUserAnAdmin.SHELL32 ref: 00981EE6
                                                                                                                                                                                                      • PathQuoteSpacesW.SHLWAPI(00000000,00000104,?), ref: 00981A4F
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00981A80
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?), ref: 00981CC8
                                                                                                                                                                                                        • Part of subcall function 00981FAD: GetTempPathW.KERNEL32(00000104,00000000,00000104,?,?,?,0098195D), ref: 00981FDC
                                                                                                                                                                                                      • lstrcmpiW.KERNELBASE(00000000,?,?,00000000,?,?,00000104), ref: 00981B2F
                                                                                                                                                                                                      • _strncpy.LIBCMT ref: 00981B89
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Path$AdminCloseFileHandleModuleNameQuoteSpacesTempUser_strncpylstrcmpi
                                                                                                                                                                                                      • String ID: "%s"$ %s$ /%s %s /%s$ /%s /%s$&%s$&referral=%s$install$installsource$silent$taggedmi
                                                                                                                                                                                                      • API String ID: 2688778804-3043945572
                                                                                                                                                                                                      • Opcode ID: 0b1dddc11376e74d42d2595b66e5597e58d136d07d59831d38546f40c6dd548d
                                                                                                                                                                                                      • Instruction ID: 612684b3826c5c63f8f490cb5634c521c1e50da101c56c1db389b7f262d30ba6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b1dddc11376e74d42d2595b66e5597e58d136d07d59831d38546f40c6dd548d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AE915C71D402189BCF24FF68DC99BDDB7B8AF94300F1045E9A409A7392EA749E86CF50
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00983555 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 631 983555-98359f call 9984f0 ReadFile 634 983768 631->634 635 9835a5-9835af 631->635 637 98376a-983778 call 987182 634->637 635->634 636 9835b5-9835cd call 998874 635->636 642 9835cf-9835d2 636->642 643 9835d7-9835ef call 998874 636->643 642->637 643->634 646 9835f5-98364e call 982f7a call 98377b * 2 CreateFileW 643->646 653 983759-983766 call 982f5f 646->653 654 983654-98368f call 999ad4 SetFilePointer 646->654 653->637 659 983691-98369e 654->659 660 983706-983718 FindCloseChangeNotification 654->660 661 9836a8-9836c3 ReadFile 659->661 662 9836a0-9836a2 659->662 663 98371a-98371d 660->663 664 983742-983745 660->664 667 983700 661->667 668 9836c5-9836e8 WriteFile 661->668 662->661 669 98372e-983733 663->669 670 98371f-983729 call 98293d 663->670 665 983753 664->665 666 983747-98374d SetFilePointer 664->666 665->653 666->665 667->660 668->667 671 9836ea-9836fc 668->671 669->664 673 983735-98373e call 9821ce 669->673 670->669 671->659 674 9836fe 671->674 675 983740-983741 673->675 674->660 675->664
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • ReadFile.KERNELBASE(?,?,00000200,?,00000000,?,00000000,?,?,009819E0,?), ref: 00983597
                                                                                                                                                                                                      • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000100,00000000,?,0099FDC8), ref: 0098363F
                                                                                                                                                                                                      • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00983673
                                                                                                                                                                                                      • ReadFile.KERNELBASE(?,?,00040000,?,00000000), ref: 009836BB
                                                                                                                                                                                                      • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 009836E0
                                                                                                                                                                                                      • FindCloseChangeNotification.KERNELBASE(?), ref: 0098370C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$Read$ChangeCloseCreateFindNotificationPointerWrite
                                                                                                                                                                                                      • String ID: ustar
                                                                                                                                                                                                      • API String ID: 3368226178-529472938
                                                                                                                                                                                                      • Opcode ID: df1b5ea183b1e2a6e3f84b9938394d30d936ed60ae09d2d081ff4af4a78bb632
                                                                                                                                                                                                      • Instruction ID: 95f3659bc8aead464b6c319789216f3a5edb8bc4f302278f2cd58805c6d198f8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: df1b5ea183b1e2a6e3f84b9938394d30d936ed60ae09d2d081ff4af4a78bb632
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0351A4F154021DAEDF20AB64CD99EAA777CEF04700F0044A9E609F6290E6B09B84CF54
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00982604 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71registrystringCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 677 982604-982637 call 982b50 call 982f5f 682 9826d9-9826e8 call 987182 677->682 683 98263d-982668 call 987760 GetModuleFileNameW 677->683 683->682 688 98266a-98266c 683->688 688->682 689 98266e-982697 RegCreateKeyExW 688->689 689->682 690 982699-9826cb lstrlenW RegSetValueExW 689->690 690->682 691 9826cd-9826d3 RegCloseKey 690->691 691->682
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00982660
                                                                                                                                                                                                      • RegCreateKeyExW.KERNELBASE(80000001,Software\BraveSoftware\Promo,?,?,?,00020006,?,?,?), ref: 0098268F
                                                                                                                                                                                                      • lstrlenW.KERNEL32(?), ref: 009826A0
                                                                                                                                                                                                      • RegSetValueExW.KERNELBASE(?,StubInstallerPath,?,00000001,?,00000000), ref: 009826C3
                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 009826D3
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateFileModuleNameValuelstrlen
                                                                                                                                                                                                      • String ID: Software\BraveSoftware\Promo$StubInstallerPath
                                                                                                                                                                                                      • API String ID: 2554618631-4237694635
                                                                                                                                                                                                      • Opcode ID: 56db00602e2173e3a74cc663953810efd47986e9f3a87049a726f653c441958c
                                                                                                                                                                                                      • Instruction ID: 759bb287160956bf10008110f9ae17d34f1be6abd2cb3485ef89bc4bb472175b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 56db00602e2173e3a74cc663953810efd47986e9f3a87049a726f653c441958c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E1216F70A5222CABDB20EB55DC4DFDB7B7CEF55350F0001A6B40AE2251EB309A84CBA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009837E2 Relevance: 10.6, APIs: 7, Instructions: 84processsynchronizationCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetStartupInfoW.KERNEL32(?,?,?,00000000), ref: 0098381C
                                                                                                                                                                                                      • CreateProcessW.KERNELBASE(00000000,00000010,00000000,00000000,00000000,00000400,00000000,00000000,?,?), ref: 00983857
                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00983861
                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00983873
                                                                                                                                                                                                      • GetExitCodeProcess.KERNELBASE(?,?), ref: 00983884
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 0098389D
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 009838A2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseHandleProcess$CodeCreateErrorExitInfoLastObjectSingleStartupWait
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2373000011-0
                                                                                                                                                                                                      • Opcode ID: 63b475b27955d01a061642fc056e0845ed66b48dcc071529685331652f4e48e7
                                                                                                                                                                                                      • Instruction ID: 77a4ee446241048257988ab6cbc145c8022a2be74e10aea1ccb865f7c359c0e8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 63b475b27955d01a061642fc056e0845ed66b48dcc071529685331652f4e48e7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C214F7191420DBFEB00AFF8CC86DAEBB7CEF04754F104466B612A3260EA305E45DBA1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00981EDD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsUserAnAdmin.SHELL32 ref: 00981EE6
                                                                                                                                                                                                      • SHGetFolderPathW.SHELL32(00000000,00008026,00000000,00000000,00000000,00000104,?,?,?,?,00981952), ref: 00981F25
                                                                                                                                                                                                      • CreateDirectoryW.KERNELBASE(?,00000000,BraveSoftware,?,?,?,?,?,00981952), ref: 00981F55
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,00981952), ref: 00981F5F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AdminCreateDirectoryErrorFolderLastPathUser
                                                                                                                                                                                                      • String ID: BraveSoftware$Temp
                                                                                                                                                                                                      • API String ID: 943171645-1868006839
                                                                                                                                                                                                      • Opcode ID: f1b83d4bd95417525eaa44fdaab766dbf04a4d347cf6049c9df04705e3a710e1
                                                                                                                                                                                                      • Instruction ID: f2533d0b1e490ba3705948834afe77cbd9cb79bca854783b4f58a1c5d1a086f8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1b83d4bd95417525eaa44fdaab766dbf04a4d347cf6049c9df04705e3a710e1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 87215E71904209AFCF10FBA4CD96EEEB7BCEF91354F5001A5A506E2292EB709F05DB60
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00981E34 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 738 981e34-981e4f CreateDirectoryW 739 981e51-981e5c GetLastError 738->739 740 981e62-981e9e call 982bff call 982c26 GetTempFileNameW call 9828b9 738->740 739->740 741 981e5e-981e60 739->741 749 981ecd-981ed5 call 982f5f 740->749 750 981ea0-981ea3 740->750 743 981ed7-981eda 741->743 749->743 750->749 752 981ea5-981eba DeleteFileW CreateDirectoryW 750->752 752->749 754 981ebc-981ecb call 982aef 752->754 754->749
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,Temp,?,?,?,?,00981952), ref: 00981E47
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,Temp,?,?,?,?,00981952), ref: 00981E51
                                                                                                                                                                                                      • GetTempFileNameW.KERNELBASE(?,GUM,00000000,00000000,00000104,?,00000000,Temp), ref: 00981E8C
                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(000000FF,?,00000000,Temp), ref: 00981EA8
                                                                                                                                                                                                      • CreateDirectoryW.KERNELBASE(000000FF,00000000,?,00000000,Temp), ref: 00981EB2
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectoryFile$DeleteErrorLastNameTemp
                                                                                                                                                                                                      • String ID: GUM
                                                                                                                                                                                                      • API String ID: 55127950-1161156203
                                                                                                                                                                                                      • Opcode ID: 6901dbb2360e2f4f6ad4df67ff452bc27346ed26ae8ebe6ed46c074d957e678b
                                                                                                                                                                                                      • Instruction ID: 200eeea2670c62d087a560569f93c14b23e85dd74bade607667c36061b74ca01
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6901dbb2360e2f4f6ad4df67ff452bc27346ed26ae8ebe6ed46c074d957e678b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D11A371500209AFDF10BFA8CC859AD7BBDEF45354F104429F815D72A1EB359E46DB90
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098344A Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 790 98344a-98347a call 9834e2 CreateFileW 793 9834da 790->793 794 98347c-98348e CreateFileMappingW 790->794 795 9834dc-9834df 793->795 796 983490-9834a3 MapViewOfFile 794->796 797 9834d3-9834d5 call 9834e2 794->797 799 9834ca-9834cd CloseHandle 796->799 800 9834a5-9834be VirtualQuery 796->800 797->793 799->797 800->799 801 9834c0-9834c8 800->801 801->795
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 009834E2: UnmapViewOfFile.KERNEL32(00000000,?,00983433,?,?,80004005,74DEE010,?,?,?,009814FB), ref: 009834EE
                                                                                                                                                                                                        • Part of subcall function 009834E2: CloseHandle.KERNEL32(00000000,?,00983433,?,?,80004005,74DEE010,?,?,?,009814FB), ref: 00983501
                                                                                                                                                                                                        • Part of subcall function 009834E2: CloseHandle.KERNEL32(000000FF,?,00983433,?,?,80004005,74DEE010,?,?,?,009814FB), ref: 00983514
                                                                                                                                                                                                      • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?,?,009815A4), ref: 0098346E
                                                                                                                                                                                                      • CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,009815A4), ref: 00983483
                                                                                                                                                                                                      • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?,?,?,?,?,?,009815A4), ref: 00983496
                                                                                                                                                                                                      • VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,?,?,?,009815A4), ref: 009834B6
                                                                                                                                                                                                      • CloseHandle.KERNEL32(6E6B6E75,?,?,?,?,?,?,009815A4), ref: 009834CD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$CloseHandle$CreateView$MappingQueryUnmapVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1729669285-0
                                                                                                                                                                                                      • Opcode ID: e3c7147756dd4f1cc31330538398ba3ab30b1f676d747618edf329d3b72598f6
                                                                                                                                                                                                      • Instruction ID: 8c5eb7576cf41c7708cf3ebcbb3c11fb748cb4444e7f78b61c976bb260c31925
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e3c7147756dd4f1cc31330538398ba3ab30b1f676d747618edf329d3b72598f6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E117070604341BAEB316B3A9C09F5B7ABDEBC1F10F00C51DB516A62A0DAB4D542D660
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00982132 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104,?,00000000,?,009819F8,?), ref: 00982164
                                                                                                                                                                                                        • Part of subcall function 00982860: PathAppendW.SHLWAPI(00000000,?,00000104,?,00000000,?,00981F51,BraveSoftware,?,?,?,?,?,00981952), ref: 00982875
                                                                                                                                                                                                      • CopyFileW.KERNELBASE(?,?,00000000,BraveUpdateSetup.exe,?,?,00000000,?,009819F8,?), ref: 0098219F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$AppendCopyModuleNamePath
                                                                                                                                                                                                      • String ID: BraveUpdateSetup.exe
                                                                                                                                                                                                      • API String ID: 1240757089-2590033563
                                                                                                                                                                                                      • Opcode ID: e17c809385b63efd16b62c7ffcae458b990bb311cc07022215701e35a1a6a24c
                                                                                                                                                                                                      • Instruction ID: 9e5d45815f7e88b7be5bac1470c0e701715dc58d987eb48935dba2559d7a6ba5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e17c809385b63efd16b62c7ffcae458b990bb311cc07022215701e35a1a6a24c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B117C75900208AFCF00FFA4CD969EEB7BCEB84310B100169E542A3291EB349F05DB60
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00989FF5 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(0098A108,?,00989FEF,00000000,?,?,0098A108,C8451F5E,?,0098A108), ref: 0098A006
                                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000,?,00989FEF,00000000,?,?,0098A108,C8451F5E,?,0098A108), ref: 0098A00D
                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0098A01F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                      • Opcode ID: e5af0a08476ce56126ce71138c091a7e67bae2c6863d0cd8be7851232bcf1fe7
                                                                                                                                                                                                      • Instruction ID: 8e0fceed67b5feb4273d05479eaeeb733a8727c01916165cd33bd140d3f5ca7a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e5af0a08476ce56126ce71138c091a7e67bae2c6863d0cd8be7851232bcf1fe7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BFD09E31415608ABEF113F64DC0DA5D3F2AFF46351B444012F90556171CF35D956AB92
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009821CE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 144COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 830 9821ce-9821f8 call 982ba0 call 98293d 835 9821fa-9821fc 830->835 836 9821fe-982204 call 98fb36 830->836 838 982205-98220b 835->838 836->838 840 982215-982217 838->840 841 982219-98221c 840->841 842 98220d-982210 840->842 843 98221e-982220 841->843 845 982271-98227c call 982f7a 841->845 842->843 844 982212 842->844 843->845 847 982222-982226 843->847 844->840 850 98227f-982294 call 982c26 845->850 847->845 849 982228-982232 847->849 851 982234 849->851 852 982236-98223f 849->852 861 98229a-9822b6 CharLowerBuffW call 982e7d 850->861 862 982332 850->862 851->852 854 982245-98224a 852->854 855 9822c6-9822cb 852->855 858 98224c-98224e 854->858 859 982250-982252 854->859 856 982337-982346 call 98103b call 9821ce 855->856 872 98234b-98234c 856->872 858->859 863 982254 859->863 864 982256-98226f call 982da5 call 982e1c 859->864 873 9822b8-9822c4 861->873 874 98231b-98232f call 982f5f * 2 861->874 862->856 863->864 864->850 873->855 876 9822cd-9822cf 873->876 879 9822d1 876->879 880 9822d3-9822fa call 982da5 call 982e1c call 999967 876->880 879->880 889 9822fc-982308 880->889 890 982313-982316 call 982f5f 880->890 889->890 891 98230a-98230e call 982aef 889->891 890->874 891->890
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CharLowerBuffW.USER32(00000000,?,?,?,?), ref: 0098229C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: BuffCharLower
                                                                                                                                                                                                      • String ID: .exe
                                                                                                                                                                                                      • API String ID: 2358735015-4119554291
                                                                                                                                                                                                      • Opcode ID: 1c9f6d5140e6db32f7b4770fe3b64aab0c3d4b846a6ea6ee2dc2b6995b3e5791
                                                                                                                                                                                                      • Instruction ID: 07413990bde84d462823b68e7ebd28e9909af65b09acc04c38e2f25fd1cc0906
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c9f6d5140e6db32f7b4770fe3b64aab0c3d4b846a6ea6ee2dc2b6995b3e5791
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 71418531500108AFCB28FF64C995DAE77ADEF90350B604669F926D7396EB30AF45CB50
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00984B06 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00983A75: lstrcpynW.KERNEL32(?,?,00000104,?,?), ref: 00983A99
                                                                                                                                                                                                        • Part of subcall function 00983A75: PathStripPathW.SHLWAPI(?,?,00000104,?,?), ref: 00983AA6
                                                                                                                                                                                                        • Part of subcall function 00983A75: PathRemoveExtensionW.SHLWAPI(?,?,00000104,?,?), ref: 00983AB3
                                                                                                                                                                                                        • Part of subcall function 00983A75: lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 00983AC6
                                                                                                                                                                                                        • Part of subcall function 00983A75: lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 00983ADC
                                                                                                                                                                                                      • CharUpperBuffW.USER32(00000000,?,?,00000104,?,?,?,?,00982752,?), ref: 00984B43
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Path$lstrlen$BuffCharExtensionRemoveStripUpperlstrcpyn
                                                                                                                                                                                                      • String ID: none
                                                                                                                                                                                                      • API String ID: 1330847136-2140143823
                                                                                                                                                                                                      • Opcode ID: fc8b26d3e672fa97d5718f958166448ebb569c71b7a2d642ef6a31009ec48d2e
                                                                                                                                                                                                      • Instruction ID: 8af4227e289719aee1856cb29006a3130e826b75d8da35bcc895d2b569173fda
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc8b26d3e672fa97d5718f958166448ebb569c71b7a2d642ef6a31009ec48d2e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1018C31500005EBCB08FB64C956EEEB37AEE91354724059CB55367392EF70AF05DB90
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009826E9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 918 9826e9-98272d call 987760 GetModuleFileNameW 921 98275f-982766 call 982ba0 918->921 922 98272f-982731 918->922 925 98276b-98277a call 987182 921->925 922->921 924 982733-98274d call 982ba0 call 984b06 922->924 931 982752-98275d call 982f5f 924->931 931->925
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00982725
                                                                                                                                                                                                        • Part of subcall function 00984B06: CharUpperBuffW.USER32(00000000,?,?,00000104,?,?,?,?,00982752,?), ref: 00984B43
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: BuffCharFileModuleNameUpper
                                                                                                                                                                                                      • String ID: none
                                                                                                                                                                                                      • API String ID: 2024523369-2140143823
                                                                                                                                                                                                      • Opcode ID: 3e4c6d6b01f32f62f693376a1a1939785aa2bea1c7fed3fd769a1c4888f6842a
                                                                                                                                                                                                      • Instruction ID: 1d0cc29e934aa1aa0d64dbf7ba70cdf5dada436193a081c06d665d4fec24d735
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3e4c6d6b01f32f62f693376a1a1939785aa2bea1c7fed3fd769a1c4888f6842a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4101847064011C57CB10FB61DD5AFEEB368AB91701F4009A5A406D73C1DE70AF45CBE1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009818B8 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00982845,?,?), ref: 009818DA
                                                                                                                                                                                                      • RemoveDirectoryW.KERNELBASE(?,?,00000000,?,00982845,?,?), ref: 009818F2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DeleteDirectoryFileRemove
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3325800564-0
                                                                                                                                                                                                      • Opcode ID: fc595991de6be075fe3b266caa1a779ebfe5b86842b4a8c94136048e2a567260
                                                                                                                                                                                                      • Instruction ID: 0e8b1a61a2c1d39ce4dba21f7b8335dc1a863a7d2deea2dce225d0e307097281
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc595991de6be075fe3b266caa1a779ebfe5b86842b4a8c94136048e2a567260
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 77017C311006048BC625BF24D99197AB3B6EFD13403000A7DE05B436A6DF75B80AD790
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098DD6E Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlFreeHeap.NTDLL(00000000,00000000,?,0098F9D4,0098BD16,00000000,0098BD16,?,0098F9F9,0098BD16,00000007,0098BD16,?,0099014B,0098BD16,0098BD16), ref: 0098DD84
                                                                                                                                                                                                      • GetLastError.KERNEL32(0098BD16,?,0098F9D4,0098BD16,00000000,0098BD16,?,0098F9F9,0098BD16,00000007,0098BD16,?,0099014B,0098BD16,0098BD16), ref: 0098DD8F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 485612231-0
                                                                                                                                                                                                      • Opcode ID: 322f9dee00a12bb70d1353d4dad12cc66172c2699708d535ab9577a3a13cfe57
                                                                                                                                                                                                      • Instruction ID: 62d096b692d7d2a94bbf9b157b09d309ab89edbb76f0b9a62cc658ae053e4015
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 322f9dee00a12bb70d1353d4dad12cc66172c2699708d535ab9577a3a13cfe57
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 29E08C32505614ABDB213FA8EC09F893B6CEB82792F004021F608972E0CBB08850D7D0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00982DC4 Relevance: 2.5, APIs: 2, Instructions: 39COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,?,?,009837BD,00983618,?,?), ref: 00982DDD
                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,-00000001,-00000001,?,009837BD,00983618,?,?), ref: 00982DFD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 626452242-0
                                                                                                                                                                                                      • Opcode ID: a623e9ebe2234cd83f4e421e8727eff9b575f13b15d05731675e053181930b56
                                                                                                                                                                                                      • Instruction ID: 92f17df08cf89586c91a39bf67d7032ddfe42a75d7ab3fa8e797e55056d5265a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a623e9ebe2234cd83f4e421e8727eff9b575f13b15d05731675e053181930b56
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 63F0E231304110BAEA113B488C09F7FF66DDFD1B61F10061ABA18DA3E1CEA04A0183FA
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00982369 Relevance: 1.7, APIs: 1, Instructions: 164COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 19a7eeb99dfb280f5940c2281b53ed34b66984566132057225ce0bb5686c6472
                                                                                                                                                                                                      • Instruction ID: 3d312a49cc9c49ad9f02cb1e8cf22c9bcc3616f8bd8bc35ec075f8637472c489
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 19a7eeb99dfb280f5940c2281b53ed34b66984566132057225ce0bb5686c6472
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3F512871D002289FDB24DFA8CC81AAEBBB9FF49314F2441AEE51DE7341DA3499458F50
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098FAE8 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000,0098EBDC,?,?,0098EBDC,00000220,?,?,?), ref: 0098FB1A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                      • Opcode ID: 9fc0c21d64ca140f172fe0d33897e58b1de1ca77b48248862d83b4c492cb0dbc
                                                                                                                                                                                                      • Instruction ID: 8fd6429a96c052791a586f5ccae301850cb38ecc8a848a8d31ac0a033554df43
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9fc0c21d64ca140f172fe0d33897e58b1de1ca77b48248862d83b4c492cb0dbc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6FE0A0222011119AAE313A29EC31B5A364DDF813B1B142071AC4897390EB608C0083E1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00981168 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: f06fc42db29c59c04f95124bb5ad1a06250547a3ce2b15377356b39a144d8d0a
                                                                                                                                                                                                      • Instruction ID: 2712d72a54e438f8e311fc15ec21bf9783f9fd8c8f517512be98bdb01ad509d3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f06fc42db29c59c04f95124bb5ad1a06250547a3ce2b15377356b39a144d8d0a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 41E01A30208208FFDB00AF64DC48F693BB9FFA9715F24C469F51A8E220C736D912AB50
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00983520 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00981CC7,?), ref: 00983537
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DeleteFile
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4033686569-0
                                                                                                                                                                                                      • Opcode ID: dba7c775894765fb49c0ce40f2e66c5b8910320e96383499068d15fe0f6940af
                                                                                                                                                                                                      • Instruction ID: 9ac3227f9443db1ac697090b9397d4d1ccc29a782edbb6b4d0a1f9485eee059f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dba7c775894765fb49c0ce40f2e66c5b8910320e96383499068d15fe0f6940af
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A6E08C322006008F8739BB28EC5097AB3F8FFD1B603104A3EE057936649BA06E45DB90
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098A58E Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: H_prolog3
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 431132790-0
                                                                                                                                                                                                      • Opcode ID: 14a817b8d5a7442f3853310f443ff1dc48172b82cb37b6e111de76703fc6f939
                                                                                                                                                                                                      • Instruction ID: 265510a88052e83364b42966873423a4a0c229d01b94e4e5395245a54cadc3df
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 14a817b8d5a7442f3853310f443ff1dc48172b82cb37b6e111de76703fc6f939
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DFE09A72C0020D9ADF10DFD8C452BEFBBF8AB48350F50806BA215E6141EA749744CBA1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098114D Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 0098115E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3298025750-0
                                                                                                                                                                                                      • Opcode ID: 66a8e9686bd11a52723ee71ab0f5811367d40102d0d36caa1b82aad434223ce3
                                                                                                                                                                                                      • Instruction ID: 1d7e82335cfdb77155cf10b7c5acf620c1ad3ad6d16098d1e2835ece6761a6ac
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 66a8e9686bd11a52723ee71ab0f5811367d40102d0d36caa1b82aad434223ce3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 98C01231004208AACB021E44DC09B957A68AB00305F148021B608084A0837294B1EA84
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00981138 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00981143
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                      • Opcode ID: 633b010995b1a105be1ba90dbeb1536320f58b53b908ddda4158d0168d8df281
                                                                                                                                                                                                      • Instruction ID: 70aecbc27a1b227d27c0d816e3a05b02302479a7ed5e92a36a4f699e0af010f7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 633b010995b1a105be1ba90dbeb1536320f58b53b908ddda4158d0168d8df281
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FBB09232044208FBDA011B89EC06F85BF29EB16760F10C022F608490628773A421AAE9
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00994198 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __floor_pentium4
                                                                                                                                                                                                      • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                      • API String ID: 4168288129-2761157908
                                                                                                                                                                                                      • Opcode ID: 1c517b61cde632a83c9d336d9a9d08e00756df61ebc5046090e909870f9e72d7
                                                                                                                                                                                                      • Instruction ID: 97ad48caacbf8511dcd63f0ccb30a6ba56a47782c10063cde33e2076f6e6b002
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c517b61cde632a83c9d336d9a9d08e00756df61ebc5046090e909870f9e72d7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F3D22971E086298FDF66CF28DD40BEAB7B9EB45305F1545EAD40DA7240E738AE818F41
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098324D Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,009814FB,?,009814FB), ref: 009832CE
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,?,009814FB,?,009814FB), ref: 009832DB
                                                                                                                                                                                                      • FormatMessageW.KERNEL32(00000500,00000000,00000000,00000000,00000000,00000000,009814FB,?,009814FB,?,009814FB), ref: 009832F1
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,009814FB,?,009814FB), ref: 009832FB
                                                                                                                                                                                                      • SetLastError.KERNEL32(009814FB,?,009814FB,?,009814FB), ref: 00983308
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,?,009814FB,?,009814FB), ref: 009833B4
                                                                                                                                                                                                        • Part of subcall function 009829DE: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,74DEDFA0,?,?,009833F9,-00000010,?,?,?,009814FB), ref: 00982A0F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$FindFormatFreeLocalMessageResource
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1240203180-0
                                                                                                                                                                                                      • Opcode ID: 1a34508ca336216337e4d1de4c51e5879558f0b76bb2e29bb0ec9362cf37207b
                                                                                                                                                                                                      • Instruction ID: da27637ac63f1e2cc9e1a3dc689666c166802c3d998211a04f6f26f49d1f83c9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1a34508ca336216337e4d1de4c51e5879558f0b76bb2e29bb0ec9362cf37207b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7C417E71A04204EBDB04FFA8C885EAEB7B9EF84B10F50855AE90197351EF749F04DB60
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00986D06 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00986D12
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 00986DDE
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00986DFE
                                                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(?), ref: 00986E08
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 254469556-0
                                                                                                                                                                                                      • Opcode ID: fcec295f273815613a89c3455155fa5b24bdf3149002a53c6f714557f16a40b9
                                                                                                                                                                                                      • Instruction ID: e3ee67ac55322ed4a6f5485a3409342d9e2ad3a3e74e8f79ddd5ec9fd1be0f0d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fcec295f273815613a89c3455155fa5b24bdf3149002a53c6f714557f16a40b9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A311675D0521C9BDB20EFA4D989BCDBBB8AF08700F1040AAE40DAB250EB719A84DF45
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0099168D Relevance: 4.8, APIs: 3, Instructions: 337COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: b0e0bbd5f1d96daac4612cb4a436a56454da5e40dfd1f64c71768d0abb85c165
                                                                                                                                                                                                      • Instruction ID: 49fd12cc05eed75c902b4195f4509f65be971356fe2547939126f6d70db33dcc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b0e0bbd5f1d96daac4612cb4a436a56454da5e40dfd1f64c71768d0abb85c165
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FBB10472E042479FDF158F6CC891BFEBBA9FF55354F18816AE805AB241D2349D41CBA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098DA04 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000401), ref: 0098DAFC
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000401), ref: 0098DB06
                                                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000401), ref: 0098DB13
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3906539128-0
                                                                                                                                                                                                      • Opcode ID: 02722b0d51ce506046ccbf19b7111f15ba0800a2954af092e21d9cc22d877a47
                                                                                                                                                                                                      • Instruction ID: 24c2f9eb96ae298be5b87ed8b842b57d598c77f03fd8f97955fe7d28e55121a3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 02722b0d51ce506046ccbf19b7111f15ba0800a2954af092e21d9cc22d877a47
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8231D6749112289BCB21EF68D989BCDB7B8AF08310F5041EAE41CA72A0E7709B859F45
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009811D5 Relevance: 4.6, APIs: 3, Instructions: 53memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,00982C07,?,009814FB), ref: 00981218
                                                                                                                                                                                                      • __Init_thread_footer.LIBCMT ref: 0098123F
                                                                                                                                                                                                        • Part of subcall function 009986C5: EnterCriticalSection.KERNEL32(009A43C8,009A4400,?,?,0098120E,009A4400,?,?,00982C07,?,009814FB), ref: 009986D0
                                                                                                                                                                                                        • Part of subcall function 009986C5: LeaveCriticalSection.KERNEL32(009A43C8,?,0098120E,009A4400,?,?,00982C07,?,009814FB), ref: 0099870D
                                                                                                                                                                                                      • __Init_thread_footer.LIBCMT ref: 009812A1
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalInit_thread_footerSection$EnterHeapLeaveProcess
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3363689876-0
                                                                                                                                                                                                      • Opcode ID: eeb2be20e0c6854b09f147e8f3ae46e5c1aaf8fbe2960681902a7901c0314d03
                                                                                                                                                                                                      • Instruction ID: 7846b66d5a300b0cf1f09e5f46142e915b4c22f494eb3f979d0c9d0e087d0896
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eeb2be20e0c6854b09f147e8f3ae46e5c1aaf8fbe2960681902a7901c0314d03
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DC11547252D7008BCB50AB6CFD4971537E8EBCB729F21411DE1148B2B1CBF85446ABD9
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00993D10 Relevance: 3.4, APIs: 2, Instructions: 449COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 5a5de4475321df752b8b9df09e3ac9534813bd07a6e30a606723c2d77483104b
                                                                                                                                                                                                      • Instruction ID: cefafa8e617f10a9e6432128c50c4abf3bea055335bf41caac6a312c8f59b2f1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5a5de4475321df752b8b9df09e3ac9534813bd07a6e30a606723c2d77483104b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FBF13D71E002199FDF15CFADC880AAEB7B5FF98314F158269E915AB384D730AE41CB90
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00997A0B Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00997A06,?,?,00000008,?,?,00997610,00000000), ref: 00997C38
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionRaise
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3997070919-0
                                                                                                                                                                                                      • Opcode ID: acf2e89d32364fef72e0669cf422e0e7c837d320ae5bf9229ab70a94cc1a7b1a
                                                                                                                                                                                                      • Instruction ID: cb3f797ff73aa22c4111d6e76b43027e7be409ac52087af9741aff1d85599e72
                                                                                                                                                                                                      • Opcode Fuzzy Hash: acf2e89d32364fef72e0669cf422e0e7c837d320ae5bf9229ab70a94cc1a7b1a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FDB13A31624609DFDB18CF6CC486B65BBA0FF45364F258658E8DACF2A1D735E981CB40
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00986FA5 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00986FBB
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FeaturePresentProcessor
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2325560087-0
                                                                                                                                                                                                      • Opcode ID: 081c0046d5ca55fee9bef1cce326dde2c66fc97245c9be2dd85ac1122feafbd0
                                                                                                                                                                                                      • Instruction ID: 1cf6b23800266cef8605655d66ce5f601f980035e1da463e69b2f9a48ac99a6b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 081c0046d5ca55fee9bef1cce326dde2c66fc97245c9be2dd85ac1122feafbd0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 265168B1E292159FDB24CF94D8857AABBF8FB49300F24852AE405EB350D3B5DA40DB91
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098C5D4 Relevance: 1.6, Strings: 1, Instructions: 388COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: 0
                                                                                                                                                                                                      • API String ID: 0-4108050209
                                                                                                                                                                                                      • Opcode ID: b32e4cab94612dc1a728c08738e1ed85eccd983217414c0740ad4176140f4497
                                                                                                                                                                                                      • Instruction ID: 997095573de5e853f89b471a22bf04023080bad772576844dd3b83190e10af7d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b32e4cab94612dc1a728c08738e1ed85eccd983217414c0740ad4176140f4497
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4E1ACB46006068FCB24EF68C580AAEB7F5FF49310F245A5EE4569B390E731ED46CB61
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00986E9A Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(Function_00006EA6,00986812), ref: 00986E9F
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3192549508-0
                                                                                                                                                                                                      • Opcode ID: fa9c23cd2a5b0305a0ad0c1ccd7d5f22bcb77f27c2b0199c1d7a69b9cb406763
                                                                                                                                                                                                      • Instruction ID: cbccd84c970a4b125e5b53e6718450b1f08628860058f2b88a87820a2f6cfc2d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fa9c23cd2a5b0305a0ad0c1ccd7d5f22bcb77f27c2b0199c1d7a69b9cb406763
                                                                                                                                                                                                      • Instruction Fuzzy Hash:
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00985AB6 Relevance: .5, Instructions: 502COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 07742bc48a47d668c5b7ba0a761fa324f4e69b4b27f22652eb96e8f34f5a8860
                                                                                                                                                                                                      • Instruction ID: 021b16ee505679e62afbf51bacccb9860d62a2e45844fb94cb525ed1ce856d07
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 07742bc48a47d668c5b7ba0a761fa324f4e69b4b27f22652eb96e8f34f5a8860
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8028272E005268FDF14DE79C4806BCBBF2AB84385F164679E456EB384E6349A85CF84
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098F38C Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 16ebe579c643b41b3b2ed50db8f55ad19555c0db4d7538cbefb163680043b31e
                                                                                                                                                                                                      • Instruction ID: 8ed5acc7bdddc8596037526de35658395e68888be55c1011aea0998afdacec24
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 16ebe579c643b41b3b2ed50db8f55ad19555c0db4d7538cbefb163680043b31e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D8E08C32911238EBCB15EBCCC914A8AF3ECEB84B40B6100A6F501D3210D274DE00CBD0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098A026 Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 07b441ad80737fae624cd0199c2363617cbbe7bd83f795c05ac74d04cb32a94c
                                                                                                                                                                                                      • Instruction ID: f99a78d7586d21c51790ebc956db1ffd73ba5f6b8663a948ac1ace2c86a80fd7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 07b441ad80737fae624cd0199c2363617cbbe7bd83f795c05ac74d04cb32a94c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81C08C340029008ADE29AD1082713B63358B3D27C6F80248EC8428B752C91FAC86D702
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009985DD Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • InitializeCriticalSectionAndSpinCount.KERNEL32(009A43C8,00000FA0,?,?,009985BB), ref: 009985E9
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,009985BB), ref: 009985F4
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,009985BB), ref: 00998605
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00998617
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00998625
                                                                                                                                                                                                      • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,009985BB), ref: 00998648
                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(009A43C8,00000007,?,?,009985BB), ref: 00998664
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,009985BB), ref: 00998674
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • kernel32.dll, xrefs: 00998600
                                                                                                                                                                                                      • SleepConditionVariableCS, xrefs: 00998611
                                                                                                                                                                                                      • api-ms-win-core-synch-l1-2-0.dll, xrefs: 009985EF
                                                                                                                                                                                                      • WakeAllConditionVariable, xrefs: 0099861D
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                                      • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                                      • API String ID: 2565136772-3242537097
                                                                                                                                                                                                      • Opcode ID: b120dff504a2715950faadc2331c77d1179c8ca0cc5d2d4cc8f75d9a934139b4
                                                                                                                                                                                                      • Instruction ID: c1a86375590bac62ffd1d866a6ae2660818e13bffc5f910172f2125594539bc1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b120dff504a2715950faadc2331c77d1179c8ca0cc5d2d4cc8f75d9a934139b4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4901D830A69311ABCF205BBCAE0DA2B369CEFD7755700012AFD05D6290DFB0C80496E2
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009889AB Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 00988AA8
                                                                                                                                                                                                      • type_info::operator==.LIBVCRUNTIME ref: 00988ACA
                                                                                                                                                                                                      • ___TypeMatch.LIBVCRUNTIME ref: 00988BD9
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 00988CAB
                                                                                                                                                                                                      • _UnwindNestedFrames.LIBCMT ref: 00988D2F
                                                                                                                                                                                                      • CallUnexpected.LIBVCRUNTIME ref: 00988D4A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 2123188842-393685449
                                                                                                                                                                                                      • Opcode ID: 956e62b0d1859ec6233da0007d00344256100efee6ee24c5e1a9f3eeabfee45e
                                                                                                                                                                                                      • Instruction ID: 8c7aced657ad1cc2e4c7e2ffb6cc7520c4aa910bb98a6631fbe924f9738d9d3e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 956e62b0d1859ec6233da0007d00344256100efee6ee24c5e1a9f3eeabfee45e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24B18971800209EFCF29EFA4C881AAFB7B9FF54310B94415AE8456B356DB31DA51CBB1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009873D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00987407
                                                                                                                                                                                                      • ___except_validate_context_record.LIBVCRUNTIME ref: 0098740F
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00987498
                                                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 009874C3
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00987518
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 1170836740-1018135373
                                                                                                                                                                                                      • Opcode ID: dc4ed1b9ac7579ae675ff9ae3abe2159238063cf68b6d2496c2846a5a05d7e55
                                                                                                                                                                                                      • Instruction ID: 74bfbe62e903a38808065f18ef2d90c5a3e45dd47089ab547e316d00ee75cda9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dc4ed1b9ac7579ae675ff9ae3abe2159238063cf68b6d2496c2846a5a05d7e55
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0741B830A08218ABCF10EFACC881A9EFFB6EF45324F248595E8155B362D735DA05CBD1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0099031F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,FFFFFEAF,?,C8451F5E,?,0099042C,0098BD16,?,FFFFFEAF,00000000), ref: 009903E0
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-537541572
                                                                                                                                                                                                      • Opcode ID: e737f453ae13dbfc1f6e8f9d319fc411437f3cbfc52902b13381fd84f63a56f7
                                                                                                                                                                                                      • Instruction ID: 7611a1ece9e8d4d206494d6dcb234cd6a5cc6b14bc16d8e3a1d28664872fdf03
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e737f453ae13dbfc1f6e8f9d319fc411437f3cbfc52902b13381fd84f63a56f7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4221C371A09310AFCF219B2CEC42A5A375CEFC2764B150611FD65A7291E730ED00D6D1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00983A75 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • lstrcpynW.KERNEL32(?,?,00000104,?,?), ref: 00983A99
                                                                                                                                                                                                      • PathStripPathW.SHLWAPI(?,?,00000104,?,?), ref: 00983AA6
                                                                                                                                                                                                      • PathRemoveExtensionW.SHLWAPI(?,?,00000104,?,?), ref: 00983AB3
                                                                                                                                                                                                      • lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 00983AC6
                                                                                                                                                                                                      • lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 00983ADC
                                                                                                                                                                                                      • lstrlenW.KERNEL32(?,?,00000104,?,?), ref: 00983B42
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Pathlstrlen$ExtensionRemoveStriplstrcpyn
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2958138087-0
                                                                                                                                                                                                      • Opcode ID: 03b1ef811bc883c014e1ab0249d736b37228269d5d28b9ba39fcf9efb82b1a40
                                                                                                                                                                                                      • Instruction ID: 4a3f59364cf16be15a2e3623a717536fb4db7e698e274e0ac56b2c901030d22c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 03b1ef811bc883c014e1ab0249d736b37228269d5d28b9ba39fcf9efb82b1a40
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E21B4B59052189ACF24FB78DC48AED73B8EB40714F20C6A6D426D3255E7349B85CF40
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00987A81 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,00987A78,0098774C,00986EEA), ref: 00987A8F
                                                                                                                                                                                                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00987A9D
                                                                                                                                                                                                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00987AB6
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,00987A78,0098774C,00986EEA), ref: 00987B08
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3852720340-0
                                                                                                                                                                                                      • Opcode ID: 3f8f1c171c8ffe860ad5106974d6ef7be83d7a36e959f1a76554532ebdd25be0
                                                                                                                                                                                                      • Instruction ID: 030f81c1c3988e840cee2751f26e32123e08d8653b497194d6fe52d546f2e890
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3f8f1c171c8ffe860ad5106974d6ef7be83d7a36e959f1a76554532ebdd25be0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A01B13361C3216EE65836F9EC85B7AEBA8DF56374734022AF120942E0EF51CD01A790
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098E65C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe, xrefs: 0098E678
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: C:\Users\user\Desktop\BraveBrowserSetup-BRV002.exe
                                                                                                                                                                                                      • API String ID: 0-3497388283
                                                                                                                                                                                                      • Opcode ID: ba9beddb5fd86ab2fe10911222edae7b85506b9a9bc6ef31735fd40c185a3a83
                                                                                                                                                                                                      • Instruction ID: 8237ecc8f9f4cdb6457ef42ec5b676153a8392b7e54afbad2dc9df05760213af
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ba9beddb5fd86ab2fe10911222edae7b85506b9a9bc6ef31735fd40c185a3a83
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC218972604205AFEB20BF75CCA1A6A77ADEF903647104929F85997391EB75EC408BA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00987C03 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,?,00987CC4,?,?,009A3CF8,00000000,?,00987DEF,00000004,InitializeCriticalSectionEx,0099ACD4,InitializeCriticalSectionEx,00000000), ref: 00987C93
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-2084034818
                                                                                                                                                                                                      • Opcode ID: 867a6dda86f91adc5a538d71c79602e665b51057553872ae606f8921255adc50
                                                                                                                                                                                                      • Instruction ID: 1f85ef2cd05f5d8a2b578c5d5a0a9b166f06b81c5fffcb934857596ca3b51dca
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 867a6dda86f91adc5a538d71c79602e665b51057553872ae606f8921255adc50
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A011CA31A59721ABCF226FAC9C45B59B3989F027B4F340221F946FB390D670ED0097D1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098A048 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C8451F5E,?,?,00000000,00999C93,000000FF,?,0098A01B,0098A108,?,00989FEF,00000000), ref: 0098A07D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0098A08F
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,00000000,00999C93,000000FF,?,0098A01B,0098A108,?,00989FEF,00000000), ref: 0098A0B1
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                      • Opcode ID: d44454e68ec2ae970d8f2a69dd47667049283f2c2d7a946504d6b8faff7a51c0
                                                                                                                                                                                                      • Instruction ID: 1771409d5e89ffe823e5f98b28603b0a8050f889d17cf1f34d137c73fb17fcfa
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d44454e68ec2ae970d8f2a69dd47667049283f2c2d7a946504d6b8faff7a51c0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9E012631958618AFDB219F48CC05FAEBBBCFB06B16F000226F811A26D0DB789900DBC1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009929A4 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 00992A2B
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 00992AEC
                                                                                                                                                                                                      • __freea.LIBCMT ref: 00992B53
                                                                                                                                                                                                        • Part of subcall function 0098FAE8: RtlAllocateHeap.NTDLL(00000000,0098EBDC,?,?,0098EBDC,00000220,?,?,?), ref: 0098FB1A
                                                                                                                                                                                                      • __freea.LIBCMT ref: 00992B68
                                                                                                                                                                                                      • __freea.LIBCMT ref: 00992B78
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __freea$__alloca_probe_16$AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1423051803-0
                                                                                                                                                                                                      • Opcode ID: a86b50cc7fe50c9273d3587d4cca835e18c1c1fa9d7edfe33da407f0a951d768
                                                                                                                                                                                                      • Instruction ID: a5522f05ff5955ae3bca496f6d6b1d94089147cc81efa67ed943f2bc98575790
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a86b50cc7fe50c9273d3587d4cca835e18c1c1fa9d7edfe33da407f0a951d768
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07518D7260120ABFEF259F688C81EBF37ADEB85750B250529FD08D6251E725CC5097A0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00981CDF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,00000000,00000000,00000000), ref: 00981D75
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileModuleName
                                                                                                                                                                                                      • String ID: "%s"$/%s$recover
                                                                                                                                                                                                      • API String ID: 514040917-4067204065
                                                                                                                                                                                                      • Opcode ID: dd35d9cade3df18de079557174c1b5522b7e20317dd4a90e68be2bfb039049d7
                                                                                                                                                                                                      • Instruction ID: a56463cc63ad824e7946af57cc64d1f4e7f78b38c8561dce1e41ab9f2dc411b9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dd35d9cade3df18de079557174c1b5522b7e20317dd4a90e68be2bfb039049d7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 771184B194021C6BCF20FB64DC89FDAB7BCAF55710F0045A5B919E32C1EA709A49CBA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00992E70 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetConsoleOutputCP.KERNEL32(C8451F5E,?,00000000,009A18B8), ref: 00992ED3
                                                                                                                                                                                                        • Part of subcall function 0098F15E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00992B49,?,00000000,-00000008), ref: 0098F20A
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0099312E
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00993176
                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00993219
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2112829910-0
                                                                                                                                                                                                      • Opcode ID: 8c6cab1fa9e9df2bca3e5ff9f4bfd5dddee8c34771bd9300af899705b439dc8c
                                                                                                                                                                                                      • Instruction ID: 8079fcfe6c69410600785a4e335ce868fe6543c2e562f07fd9ca7fc4905bada1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c6cab1fa9e9df2bca3e5ff9f4bfd5dddee8c34771bd9300af899705b439dc8c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8D159B5E04258AFCF15CFECD880AADBBB9FF49304F18852AE865E7351D630A945CB50
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00988754 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AdjustPointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1740715915-0
                                                                                                                                                                                                      • Opcode ID: fac42323147b908b2b378e49169f51400c0f53b8a474b0b495a991356a1f0ac9
                                                                                                                                                                                                      • Instruction ID: cebcc9f8ddf1022507fbb0d1bc1f5dc8ebd23c8e3b4a8eb1f1f8c6fed64f9a9a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fac42323147b908b2b378e49169f51400c0f53b8a474b0b495a991356a1f0ac9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5D51D3716042069FDB29BF54D841B7BB7B9EF80710FA4452DE812973A1EB31ED41C7A1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098DE72 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 0098F15E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00992B49,?,00000000,-00000008), ref: 0098F20A
                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 0098DED6
                                                                                                                                                                                                      • __dosmaperr.LIBCMT ref: 0098DEDD
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?), ref: 0098DF17
                                                                                                                                                                                                      • __dosmaperr.LIBCMT ref: 0098DF1E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1913693674-0
                                                                                                                                                                                                      • Opcode ID: 07137e5776b026f3723ec71fb45541a439aa24b7a0db0863df2cf1ee47ef97a5
                                                                                                                                                                                                      • Instruction ID: fc9180caa0b50a3babd1651734bf116b0c2af3b551b03b176c1f7d43e711e887
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 07137e5776b026f3723ec71fb45541a439aa24b7a0db0863df2cf1ee47ef97a5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14210471616205AFDB20BF65C88196BB7ACEF90364700881CF91A97391EB74EC00DBA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0098F24C Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetEnvironmentStringsW.KERNEL32 ref: 0098F254
                                                                                                                                                                                                        • Part of subcall function 0098F15E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00992B49,?,00000000,-00000008), ref: 0098F20A
                                                                                                                                                                                                      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0098F28C
                                                                                                                                                                                                      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0098F2AC
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 158306478-0
                                                                                                                                                                                                      • Opcode ID: 4ec739bd09bf0d37770c7f5d8c7468e3b7b29a0606f86d2f52056894c674041b
                                                                                                                                                                                                      • Instruction ID: 09c74dde7df3d9a6cbdf5ad1c8c0dcf3a0601d0b2776e7afb90ddd17cd9d1b0d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ec739bd09bf0d37770c7f5d8c7468e3b7b29a0606f86d2f52056894c674041b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BA1126B69162157F6B2137B59C9EE7F2A6CDE853A47201035F401D3381FA29CD0093F1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00981444 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 009814A3
                                                                                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000), ref: 009814A7
                                                                                                                                                                                                      • VerSetConditionMask.KERNEL32(00000000), ref: 009814AB
                                                                                                                                                                                                      • VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 009814CF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2793162063-0
                                                                                                                                                                                                      • Opcode ID: 2eeae923d4bc5b0806d01d8f4215932bcbf6b4242a17630362bb628499fbed23
                                                                                                                                                                                                      • Instruction ID: 849051c22b56d3c06f37698abeb7e54699f03991b2e899059fa10ca8e4ca130d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2eeae923d4bc5b0806d01d8f4215932bcbf6b4242a17630362bb628499fbed23
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F1111270A543187AEB30DB65DC0AFEFBBBCDF85B10F00409AB504A6280DAB45B449B95
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009965B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,009A18B8,00000000,00000000,?,?,00995930,?,00000001,?,009A18B8,?,0099326D,009A18B8,?,00000000), ref: 009965CD
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00995930,?,00000001,?,009A18B8,?,0099326D,009A18B8,?,00000000,009A18B8,009A18B8,?,009937F4,?), ref: 009965D9
                                                                                                                                                                                                        • Part of subcall function 0099659F: CloseHandle.KERNEL32(FFFFFFFE,009965E9,?,00995930,?,00000001,?,009A18B8,?,0099326D,009A18B8,?,00000000,009A18B8,009A18B8), ref: 009965AF
                                                                                                                                                                                                      • ___initconout.LIBCMT ref: 009965E9
                                                                                                                                                                                                        • Part of subcall function 00996561: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00996590,0099591D,009A18B8,?,0099326D,009A18B8,?,00000000,009A18B8), ref: 00996574
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,009A18B8,00000000,00000000,?,00995930,?,00000001,?,009A18B8,?,0099326D,009A18B8,?,00000000,009A18B8), ref: 009965FE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2744216297-0
                                                                                                                                                                                                      • Opcode ID: 4dd01eba849c2cbe4003644455f9de7c1f434f77a76a75556b680b0b9a8199f0
                                                                                                                                                                                                      • Instruction ID: 6cbe3aa7995f2253b1486d6c87f7a46e574d8471c86986a4c3f61c1c57fad362
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4dd01eba849c2cbe4003644455f9de7c1f434f77a76a75556b680b0b9a8199f0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F9F0C036518129BBCF622F9EDC05A9D7F66FF493A1F058011FA1895130CB328920EBD5
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0099874D Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SleepConditionVariableCS.KERNELBASE(?,009986EA,00000064), ref: 00998770
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(009A43C8,?,?,009986EA,00000064,?,0098120E,009A4400,?,?,00982C07,?,009814FB), ref: 0099877A
                                                                                                                                                                                                      • WaitForSingleObjectEx.KERNEL32(?,00000000,?,009986EA,00000064,?,0098120E,009A4400,?,?,00982C07,?,009814FB), ref: 0099878B
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(009A43C8,?,009986EA,00000064,?,0098120E,009A4400,?,?,00982C07,?,009814FB), ref: 00998792
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3269011525-0
                                                                                                                                                                                                      • Opcode ID: 03d2b0dd934ea6ed52d2998a5d1eb475a8c52f8f810e6bf860d6010a8963a6ed
                                                                                                                                                                                                      • Instruction ID: 0ef7efd4cb710e4941605b63ce122eb5a77900029b63145a36432dcdd166a7ce
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 03d2b0dd934ea6ed52d2998a5d1eb475a8c52f8f810e6bf860d6010a8963a6ed
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3BE0D831599224F7CF111F98ED09AAD3F68FF8B762B000115F90562170CFF50900ABD1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00988D55 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00988D7A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EncodePointer
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 2118026453-2084237596
                                                                                                                                                                                                      • Opcode ID: 0a761db202c5d3d215581d18c84fdae8c682fae44da0006c403652d3f9464c19
                                                                                                                                                                                                      • Instruction ID: b15f34434bb9977f777b806f01b306f790201d9058195ce71e6a77bef1f482af
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a761db202c5d3d215581d18c84fdae8c682fae44da0006c403652d3f9464c19
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DE416C71900209EFCF15EF98CC81AEEBBB9FF48300F588159F904A7262D7359951DB61
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00997FD1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00981097: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 0098109C
                                                                                                                                                                                                        • Part of subcall function 00981097: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 009810A6
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32(?,?,?,0098100A), ref: 00998004
                                                                                                                                                                                                      • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0098100A), ref: 00998013
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0099800E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.2372368893.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372333291.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372411184.000000000099A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372462585.00000000009A3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.2372713015.00000000009A5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_980000_BraveBrowserSetup-BRV002.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                                      • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                      • API String ID: 450123788-631824599
                                                                                                                                                                                                      • Opcode ID: dac96c58b482782a561e0cf8819f4787044eeb78fcbb5c630f54f01dffa742e4
                                                                                                                                                                                                      • Instruction ID: 446046d801d0d579da61403a314216a3896c22a65c25e7dfa09107e1ebdb7fa9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dac96c58b482782a561e0cf8819f4787044eeb78fcbb5c630f54f01dffa742e4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F5E0ED702047508BEB71EF6CE8053867AE4AF86754F00891DE495C2651EBF5D588DBA2
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:3.2%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                                      Total number of Nodes:1455
                                                                                                                                                                                                      Total number of Limit Nodes:31
                                                                                                                                                                                                      execution_graph 8501 aaa2a9 8502 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 8501->8502 8503 aaa2bb 8502->8503 8506 aaabde 8503->8506 8507 aaabec ___except_validate_context_record 8506->8507 8515 aa9b24 8507->8515 8509 aaac57 8514 aaa2d4 8509->8514 8531 aaa670 8509->8531 8510 aaabf2 8510->8509 8511 aaac31 8510->8511 8510->8514 8511->8514 8528 aaafe9 8511->8528 8581 aa9b32 8515->8581 8517 aa9b29 8517->8510 8595 aaeeb2 8517->8595 8520 aacd46 8522 aacd6f 8520->8522 8523 aacd50 IsProcessorFeaturePresent 8520->8523 8524 aabfc9 __FrameHandler3::FrameUnwindToState 23 API calls 8522->8524 8525 aacd5c 8523->8525 8527 aacd79 8524->8527 8526 aab83e __FrameHandler3::FrameUnwindToState 8 API calls 8525->8526 8526->8522 8651 aab001 8528->8651 8530 aaaffc 8530->8514 8535 aaa690 __FrameHandler3::FrameUnwindToState 8531->8535 8532 aaa9a8 8533 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8532->8533 8543 aaa9ae 8532->8543 8534 aaaa19 8533->8534 8535->8532 8537 aaa772 8535->8537 8538 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8535->8538 8536 aaa97d 8536->8532 8556 aaa97b 8536->8556 8685 aaaa1a 8536->8685 8537->8536 8539 aaa7fb 8537->8539 8579 aaa778 type_info::operator== 8537->8579 8542 aaa6f2 8538->8542 8546 aaa913 __InternalCxxFrameHandler 8539->8546 8670 aaa063 8539->8670 8540 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8540->8532 8542->8543 8545 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8542->8545 8543->8514 8547 aaa700 8545->8547 8548 aaa96c 8546->8548 8549 aaa957 8546->8549 8546->8556 8550 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8547->8550 8551 aab0e9 IsInExceptionSpec 41 API calls 8548->8551 8552 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8549->8552 8558 aaa708 8550->8558 8553 aaa975 8551->8553 8554 aaa95c 8552->8554 8553->8556 8557 aaa9d8 8553->8557 8555 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8554->8555 8555->8579 8556->8540 8560 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8557->8560 8558->8532 8559 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8558->8559 8561 aaa751 8559->8561 8562 aaa9dd 8560->8562 8561->8537 8566 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8561->8566 8565 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8562->8565 8564 aaa81c ___TypeMatch 8564->8546 8675 aaa5f0 8564->8675 8567 aaa9e5 8565->8567 8568 aaa75b 8566->8568 8711 aaa256 RtlUnwind 8567->8711 8569 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8568->8569 8573 aaa766 8569->8573 8572 aaa9b8 __InternalCxxFrameHandler 8708 aab2d6 8572->8708 8665 aab0e9 8573->8665 8574 aaa9f9 8575 aaafe9 __InternalCxxFrameHandler 51 API calls 8574->8575 8577 aaaa05 __InternalCxxFrameHandler 8575->8577 8712 aaaf60 8577->8712 8579->8572 8702 aacc9b 8579->8702 8582 aa9b3b 8581->8582 8583 aa9b3e GetLastError 8581->8583 8582->8517 8625 aa9f70 8583->8625 8586 aa9bb8 SetLastError 8586->8517 8587 aa9fab ___vcrt_FlsSetValue 6 API calls 8588 aa9b6c __FrameHandler3::FrameUnwindToState 8587->8588 8589 aa9b94 8588->8589 8590 aa9fab ___vcrt_FlsSetValue 6 API calls 8588->8590 8594 aa9b72 8588->8594 8591 aa9fab ___vcrt_FlsSetValue 6 API calls 8589->8591 8592 aa9ba8 8589->8592 8590->8589 8591->8592 8630 aabb0b 8592->8630 8594->8586 8633 aaede4 8595->8633 8598 aaeef7 8599 aaef03 ___scrt_is_nonwritable_in_current_image 8598->8599 8600 aad391 ___free_lconv_mon 14 API calls 8599->8600 8604 aaef30 __FrameHandler3::FrameUnwindToState 8599->8604 8605 aaef2a __FrameHandler3::FrameUnwindToState 8599->8605 8600->8605 8601 aaef77 8602 aabaf8 ___free_lconv_mon 14 API calls 8601->8602 8603 aaef7c 8602->8603 8606 aaba3a ___std_exception_copy 41 API calls 8603->8606 8607 aaefa3 8604->8607 8644 aad642 EnterCriticalSection 8604->8644 8605->8601 8605->8604 8624 aaef61 8605->8624 8606->8624 8610 aaf0d6 8607->8610 8611 aaefe5 8607->8611 8621 aaf014 8607->8621 8613 aaf0e1 8610->8613 8649 aad68a LeaveCriticalSection 8610->8649 8616 aad240 _unexpected 41 API calls 8611->8616 8611->8621 8615 aabfc9 __FrameHandler3::FrameUnwindToState 23 API calls 8613->8615 8617 aaf0e9 8615->8617 8619 aaf009 8616->8619 8618 aad240 _unexpected 41 API calls 8622 aaf069 8618->8622 8620 aad240 _unexpected 41 API calls 8619->8620 8620->8621 8645 aaf083 8621->8645 8623 aad240 _unexpected 41 API calls 8622->8623 8622->8624 8623->8624 8624->8520 8626 aa9eb1 ___vcrt_FlsGetValue 5 API calls 8625->8626 8627 aa9f8a 8626->8627 8628 aa9fa2 TlsGetValue 8627->8628 8629 aa9b53 8627->8629 8628->8629 8629->8586 8629->8587 8629->8594 8631 aad52b ___free_lconv_mon 14 API calls 8630->8631 8632 aabb23 8631->8632 8632->8594 8634 aaedf0 ___scrt_is_nonwritable_in_current_image 8633->8634 8639 aad642 EnterCriticalSection 8634->8639 8636 aaedfe 8640 aaee3c 8636->8640 8639->8636 8643 aad68a LeaveCriticalSection 8640->8643 8642 aacd3b 8642->8520 8642->8598 8643->8642 8644->8607 8646 aaf089 8645->8646 8647 aaf05a 8645->8647 8650 aad68a LeaveCriticalSection 8646->8650 8647->8618 8647->8622 8647->8624 8649->8613 8650->8647 8652 aab00d ___scrt_is_nonwritable_in_current_image __FrameHandler3::FrameUnwindToState 8651->8652 8653 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8652->8653 8657 aab028 __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 8653->8657 8654 aab0a8 8656 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8654->8656 8658 aab0ad __FrameHandler3::FrameUnwindToState 8654->8658 8659 aab0e8 8656->8659 8657->8654 8660 aab0cf 8657->8660 8658->8530 8661 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8660->8661 8662 aab0d4 8661->8662 8663 aab0df 8662->8663 8664 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8662->8664 8663->8654 8664->8663 8666 aab17d 8665->8666 8669 aab0fd ___TypeMatch 8665->8669 8667 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8666->8667 8668 aab182 8667->8668 8669->8537 8674 aaa081 8670->8674 8671 aaa0b7 8671->8564 8672 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8673 aaa0d2 8672->8673 8674->8671 8674->8672 8676 aaa60f 8675->8676 8677 aaa602 8675->8677 8728 aaa256 RtlUnwind 8676->8728 8724 aaa557 8677->8724 8680 aaa624 8681 aab001 __FrameHandler3::FrameUnwindToState 51 API calls 8680->8681 8682 aaa635 __FrameHandler3::FrameUnwindToState 8681->8682 8729 aaad9c 8682->8729 8684 aaa65d __InternalCxxFrameHandler 8684->8564 8686 aaaa30 8685->8686 8687 aaab45 8685->8687 8688 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8686->8688 8687->8556 8689 aaaa37 8688->8689 8690 aaaa3e EncodePointer 8689->8690 8691 aaaa79 8689->8691 8694 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8690->8694 8691->8687 8692 aaab4a 8691->8692 8693 aaaa96 8691->8693 8695 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8692->8695 8696 aaa063 __InternalCxxFrameHandler 41 API calls 8693->8696 8698 aaaa4c 8694->8698 8697 aaab4f 8695->8697 8700 aaaaad 8696->8700 8698->8691 8699 aaa130 CallCatchBlock 51 API calls 8698->8699 8699->8691 8700->8687 8701 aaa5f0 __InternalCxxFrameHandler 53 API calls 8700->8701 8701->8700 8703 aacca7 ___scrt_is_nonwritable_in_current_image 8702->8703 8704 aad240 _unexpected 41 API calls 8703->8704 8707 aaccac 8704->8707 8705 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8706 aaccd6 8705->8706 8707->8705 8709 aab31d RaiseException 8708->8709 8710 aab2f0 8708->8710 8709->8557 8710->8709 8711->8574 8713 aaaf6c __EH_prolog3_catch 8712->8713 8714 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8713->8714 8715 aaaf71 8714->8715 8716 aaaf94 8715->8716 8791 aab20c 8715->8791 8717 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8716->8717 8720 aaaf99 8717->8720 8725 aaa563 ___scrt_is_nonwritable_in_current_image 8724->8725 8743 aaa419 8725->8743 8727 aaa58b __InternalCxxFrameHandler ___AdjustPointer 8727->8676 8728->8680 8730 aaada8 ___scrt_is_nonwritable_in_current_image 8729->8730 8750 aaa2da 8730->8750 8733 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8734 aaadd4 8733->8734 8735 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8734->8735 8736 aaaddf 8735->8736 8737 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8736->8737 8738 aaadea 8737->8738 8739 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8738->8739 8740 aaadf2 CallCatchBlock 8739->8740 8755 aaaee4 8740->8755 8742 aaaecc 8742->8684 8744 aaa425 ___scrt_is_nonwritable_in_current_image 8743->8744 8745 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8744->8745 8746 aaa4a0 __InternalCxxFrameHandler ___AdjustPointer 8744->8746 8747 aaa556 ___scrt_is_nonwritable_in_current_image 8745->8747 8746->8727 8748 aaa419 __InternalCxxFrameHandler 41 API calls 8747->8748 8749 aaa58b __InternalCxxFrameHandler ___AdjustPointer 8748->8749 8749->8727 8751 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8750->8751 8752 aaa2eb 8751->8752 8753 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8752->8753 8754 aaa2f6 8753->8754 8754->8733 8764 aaa2fe 8755->8764 8757 aaaef5 8758 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8757->8758 8759 aaaefb 8758->8759 8760 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8759->8760 8761 aaaf06 8760->8761 8763 aaaf47 __InternalCxxFrameHandler 8761->8763 8783 aa9a14 8761->8783 8763->8742 8765 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8764->8765 8766 aaa307 8765->8766 8767 aaa30f 8766->8767 8768 aaa31d 8766->8768 8769 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8767->8769 8770 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8768->8770 8771 aaa317 8769->8771 8773 aaa322 8770->8773 8771->8757 8772 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 8774 aaa345 8772->8774 8773->8771 8773->8772 8775 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 8774->8775 8776 aaa35a 8775->8776 8777 aaabde __InternalCxxFrameHandler 54 API calls 8776->8777 8782 aaa365 8776->8782 8778 aaa39d 8777->8778 8779 aaa3b4 8778->8779 8786 aaa256 RtlUnwind 8778->8786 8787 aaa130 8779->8787 8782->8757 8784 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8783->8784 8785 aa9a1c 8784->8785 8785->8763 8786->8779 8788 aaa152 CallCatchBlock 8787->8788 8790 aaa140 8787->8790 8789 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8788->8789 8789->8790 8790->8782 8792 aa9b24 __FrameHandler3::FrameUnwindToState 51 API calls 8791->8792 8793 aab212 8792->8793 8794 aacc9b _unexpected 41 API calls 8793->8794 8795 aab228 8794->8795 9455 aaec27 9456 aaec33 ___scrt_is_nonwritable_in_current_image 9455->9456 9467 aad642 EnterCriticalSection 9456->9467 9458 aaec3a 9459 aaf663 42 API calls 9458->9459 9460 aaec49 9459->9460 9461 aaec58 9460->9461 9468 aaeac1 GetStartupInfoW 9460->9468 9479 aaec7e 9461->9479 9467->9458 9469 aaeade 9468->9469 9471 aaeb72 9468->9471 9470 aaf663 42 API calls 9469->9470 9469->9471 9472 aaeb06 9470->9472 9474 aaeb77 9471->9474 9472->9471 9473 aaeb36 GetFileType 9472->9473 9473->9472 9475 aaeb7e 9474->9475 9476 aaebc1 GetStdHandle 9475->9476 9477 aaec23 9475->9477 9478 aaebd4 GetFileType 9475->9478 9476->9475 9477->9461 9478->9475 9482 aad68a LeaveCriticalSection 9479->9482 9481 aaec69 9482->9481 7455 aa7a3a 7464 aa7d04 GetModuleHandleW 7455->7464 7458 aa7a78 7469 aabfc9 7458->7469 7459 aa7a46 7461 aa7a51 7459->7461 7466 aabfab 7459->7466 7465 aa7a42 7464->7465 7465->7458 7465->7459 7472 aabe30 7466->7472 7470 aabe30 __FrameHandler3::FrameUnwindToState 23 API calls 7469->7470 7471 aa7a80 7470->7471 7473 aabe6f 7472->7473 7474 aabe5d 7472->7474 7490 aabcd9 7473->7490 7476 aa7d04 __FrameHandler3::FrameUnwindToState GetModuleHandleW 7474->7476 7477 aabe62 7476->7477 7477->7473 7484 aabf1a GetModuleHandleExW 7477->7484 7479 aabeac 7479->7461 7485 aabf7a 7484->7485 7486 aabf59 GetProcAddress 7484->7486 7487 aabe6e 7485->7487 7488 aabf80 FreeLibrary 7485->7488 7486->7485 7489 aabf6d 7486->7489 7487->7473 7488->7487 7489->7485 7491 aabce5 ___scrt_is_nonwritable_in_current_image 7490->7491 7505 aad642 EnterCriticalSection 7491->7505 7493 aabcef 7506 aabd45 7493->7506 7495 aabcfc 7510 aabd1a 7495->7510 7498 aabec7 7567 aabef8 7498->7567 7501 aabee5 7503 aabf1a __FrameHandler3::FrameUnwindToState 3 API calls 7501->7503 7502 aabed5 GetCurrentProcess TerminateProcess 7502->7501 7504 aabeed ExitProcess 7503->7504 7505->7493 7508 aabd51 ___scrt_is_nonwritable_in_current_image 7506->7508 7507 aabdb8 __FrameHandler3::FrameUnwindToState 7507->7495 7508->7507 7513 aac823 7508->7513 7566 aad68a LeaveCriticalSection 7510->7566 7512 aabd08 7512->7479 7512->7498 7514 aac82f __EH_prolog3 7513->7514 7517 aac57b 7514->7517 7516 aac856 __FrameHandler3::FrameUnwindToState 7516->7507 7518 aac587 ___scrt_is_nonwritable_in_current_image 7517->7518 7525 aad642 EnterCriticalSection 7518->7525 7520 aac595 7526 aac733 7520->7526 7525->7520 7527 aac752 7526->7527 7528 aac5a2 7526->7528 7527->7528 7533 aad52b 7527->7533 7530 aac5ca 7528->7530 7565 aad68a LeaveCriticalSection 7530->7565 7532 aac5b3 7532->7516 7534 aad536 HeapFree 7533->7534 7538 aad560 7533->7538 7535 aad54b GetLastError 7534->7535 7534->7538 7536 aad558 ___free_lconv_mon 7535->7536 7539 aabaf8 7536->7539 7538->7528 7542 aad391 GetLastError 7539->7542 7541 aabafd 7541->7538 7543 aad3ad 7542->7543 7544 aad3a7 7542->7544 7546 aae941 _unexpected 6 API calls 7543->7546 7548 aad3b1 SetLastError 7543->7548 7545 aae902 _unexpected 6 API calls 7544->7545 7545->7543 7547 aad3c9 7546->7547 7547->7548 7550 aad6d2 _unexpected 12 API calls 7547->7550 7548->7541 7551 aad3de 7550->7551 7552 aad3e6 7551->7552 7553 aad3f7 7551->7553 7555 aae941 _unexpected 6 API calls 7552->7555 7554 aae941 _unexpected 6 API calls 7553->7554 7557 aad403 7554->7557 7556 aad3f4 7555->7556 7561 aad52b ___free_lconv_mon 12 API calls 7556->7561 7558 aad41e 7557->7558 7559 aad407 7557->7559 7562 aad06e _unexpected 12 API calls 7558->7562 7560 aae941 _unexpected 6 API calls 7559->7560 7560->7556 7561->7548 7563 aad429 7562->7563 7564 aad52b ___free_lconv_mon 12 API calls 7563->7564 7564->7548 7565->7532 7566->7512 7572 aad6a1 GetPEB 7567->7572 7570 aabf02 GetPEB 7571 aabed1 7570->7571 7571->7501 7571->7502 7573 aad6bb 7572->7573 7575 aabefd 7572->7575 7576 aae844 7573->7576 7575->7570 7575->7571 7579 aae7c1 7576->7579 7580 aae7ef 7579->7580 7585 aae7eb 7579->7585 7580->7585 7586 aae6f6 7580->7586 7583 aae809 GetProcAddress 7584 aae819 _unexpected 7583->7584 7583->7585 7584->7585 7585->7575 7592 aae707 7586->7592 7587 aae79d 7587->7583 7587->7585 7588 aae725 LoadLibraryExW 7589 aae740 GetLastError 7588->7589 7590 aae7a4 7588->7590 7589->7592 7590->7587 7591 aae7b6 FreeLibrary 7590->7591 7591->7587 7592->7587 7592->7588 7593 aae773 LoadLibraryExW 7592->7593 7593->7590 7593->7592 8819 aaeab8 GetStartupInfoW 8820 aaeade 8819->8820 8821 aaeb72 8819->8821 8820->8821 8825 aaf663 8820->8825 8823 aaeb06 8823->8821 8824 aaeb36 GetFileType 8823->8824 8824->8823 8826 aaf66f ___scrt_is_nonwritable_in_current_image 8825->8826 8827 aaf678 8826->8827 8828 aaf699 8826->8828 8829 aabaf8 ___free_lconv_mon 14 API calls 8827->8829 8838 aad642 EnterCriticalSection 8828->8838 8831 aaf67d 8829->8831 8832 aaba3a ___std_exception_copy 41 API calls 8831->8832 8834 aaf687 8832->8834 8833 aaf6d1 8846 aaf6f8 8833->8846 8834->8823 8835 aaf6a5 8835->8833 8839 aaf5b3 8835->8839 8838->8835 8840 aad6d2 _unexpected 14 API calls 8839->8840 8841 aaf5c5 8840->8841 8845 aaf5d2 8841->8845 8849 aae983 8841->8849 8842 aad52b ___free_lconv_mon 14 API calls 8844 aaf627 8842->8844 8844->8835 8845->8842 8854 aad68a LeaveCriticalSection 8846->8854 8848 aaf6ff 8848->8834 8850 aae7c1 _unexpected 5 API calls 8849->8850 8851 aae99f 8850->8851 8852 aae9bd InitializeCriticalSectionAndSpinCount 8851->8852 8853 aae9a8 8851->8853 8852->8853 8853->8841 8854->8848 9567 aad107 9568 aad112 9567->9568 9572 aad122 9567->9572 9573 aad128 9568->9573 9571 aad52b ___free_lconv_mon 14 API calls 9571->9572 9574 aad13d 9573->9574 9575 aad143 9573->9575 9576 aad52b ___free_lconv_mon 14 API calls 9574->9576 9577 aad52b ___free_lconv_mon 14 API calls 9575->9577 9576->9575 9578 aad14f 9577->9578 9579 aad52b ___free_lconv_mon 14 API calls 9578->9579 9580 aad15a 9579->9580 9581 aad52b ___free_lconv_mon 14 API calls 9580->9581 9582 aad165 9581->9582 9583 aad52b ___free_lconv_mon 14 API calls 9582->9583 9584 aad170 9583->9584 9585 aad52b ___free_lconv_mon 14 API calls 9584->9585 9586 aad17b 9585->9586 9587 aad52b ___free_lconv_mon 14 API calls 9586->9587 9588 aad186 9587->9588 9589 aad52b ___free_lconv_mon 14 API calls 9588->9589 9590 aad191 9589->9590 9591 aad52b ___free_lconv_mon 14 API calls 9590->9591 9592 aad19c 9591->9592 9593 aad52b ___free_lconv_mon 14 API calls 9592->9593 9594 aad1aa 9593->9594 9599 aacf54 9594->9599 9600 aacf60 ___scrt_is_nonwritable_in_current_image 9599->9600 9615 aad642 EnterCriticalSection 9600->9615 9602 aacf94 9616 aacfb3 9602->9616 9605 aacf6a 9605->9602 9606 aad52b ___free_lconv_mon 14 API calls 9605->9606 9606->9602 9607 aacfbf 9608 aacfcb ___scrt_is_nonwritable_in_current_image 9607->9608 9620 aad642 EnterCriticalSection 9608->9620 9610 aacfd5 9611 aad1f5 _unexpected 14 API calls 9610->9611 9612 aacfe8 9611->9612 9621 aad008 9612->9621 9615->9605 9619 aad68a LeaveCriticalSection 9616->9619 9618 aacfa1 9618->9607 9619->9618 9620->9610 9624 aad68a LeaveCriticalSection 9621->9624 9623 aacff6 9623->9571 9624->9623 7795 aa7905 7796 aa7911 ___scrt_is_nonwritable_in_current_image 7795->7796 7821 aa7657 7796->7821 7798 aa7918 7799 aa7a6b 7798->7799 7808 aa7942 ___scrt_is_nonwritable_in_current_image __FrameHandler3::FrameUnwindToState ___scrt_release_startup_lock 7798->7808 7867 aa7bb0 IsProcessorFeaturePresent 7799->7867 7801 aa7a72 7849 aac006 7801->7849 7804 aabfc9 __FrameHandler3::FrameUnwindToState 23 API calls 7805 aa7a80 7804->7805 7806 aa7961 7808->7806 7812 aa79e2 7808->7812 7852 aabfe0 7808->7852 7809 aa79e8 7833 aa6c1e GetModuleHandleW GetProcAddress 7809->7833 7829 aa7ccb 7812->7829 7813 aa79fd 7814 aa7d04 __FrameHandler3::FrameUnwindToState GetModuleHandleW 7813->7814 7815 aa7a04 7814->7815 7815->7801 7816 aa7a08 7815->7816 7817 aa7a11 7816->7817 7858 aabfba 7816->7858 7861 aa77c8 7817->7861 7822 aa7660 7821->7822 7871 aa7db1 IsProcessorFeaturePresent 7822->7871 7826 aa7671 7828 aa7675 7826->7828 7881 aa9759 7826->7881 7828->7798 7943 aa95e0 7829->7943 7832 aa7cf1 7832->7809 7834 aa6c3d 7833->7834 7945 aa6887 7834->7945 7836 aa6c4c 7972 aa6dd7 7836->7972 7838 aa6c56 7975 aa6a8c 7838->7975 7841 aa6c6b LoadLibraryExW 7842 aa6c7e 7841->7842 7843 aa6c87 GetProcAddress 7841->7843 8006 aa6820 GetLastError 7842->8006 7845 aa6ca5 FreeLibrary 7843->7845 7846 aa6c99 GetCommandLineW 7843->7846 7848 aa6c83 7845->7848 7846->7845 7848->7813 7850 aabe30 __FrameHandler3::FrameUnwindToState 23 API calls 7849->7850 7851 aa7a78 7850->7851 7851->7804 7853 aabff6 ___scrt_is_nonwritable_in_current_image _unexpected 7852->7853 7853->7812 8304 aad240 GetLastError 7853->8304 7855 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 7856 aaccd6 7855->7856 7859 aabe30 __FrameHandler3::FrameUnwindToState 23 API calls 7858->7859 7860 aabfc5 7859->7860 7860->7817 7862 aa77d4 7861->7862 7863 aa77ea 7862->7863 8331 aac9ca 7862->8331 7863->7806 7865 aa77e2 7866 aa9759 ___scrt_uninitialize_crt 7 API calls 7865->7866 7866->7863 7868 aa7bc6 __FrameHandler3::FrameUnwindToState 7867->7868 7869 aa7c71 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7868->7869 7870 aa7cbc __FrameHandler3::FrameUnwindToState 7869->7870 7870->7801 7872 aa766c 7871->7872 7873 aa973a 7872->7873 7887 aa9c12 7873->7887 7875 aa9743 7875->7826 7878 aa974b 7879 aa9756 7878->7879 7901 aa9c4e 7878->7901 7879->7826 7882 aa976c 7881->7882 7883 aa9762 7881->7883 7882->7828 7884 aa9bf7 ___vcrt_uninitialize_ptd 6 API calls 7883->7884 7885 aa9767 7884->7885 7886 aa9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7885->7886 7886->7882 7888 aa9c1b 7887->7888 7890 aa9c44 7888->7890 7891 aa973f 7888->7891 7905 aa9fe9 7888->7905 7892 aa9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7890->7892 7891->7875 7893 aa9bc4 7891->7893 7892->7891 7924 aa9efa 7893->7924 7896 aa9bd9 7896->7878 7899 aa9bf4 7899->7878 7902 aa9c78 7901->7902 7903 aa9c59 7901->7903 7902->7875 7904 aa9c63 DeleteCriticalSection 7903->7904 7904->7902 7904->7904 7910 aa9eb1 7905->7910 7908 aaa021 InitializeCriticalSectionAndSpinCount 7909 aaa00c 7908->7909 7909->7888 7911 aa9ec9 7910->7911 7912 aa9eec 7910->7912 7911->7912 7916 aa9e17 7911->7916 7912->7908 7912->7909 7915 aa9ede GetProcAddress 7915->7912 7922 aa9e23 7916->7922 7917 aa9e97 7917->7912 7917->7915 7918 aa9e39 LoadLibraryExW 7919 aa9e9e 7918->7919 7920 aa9e57 GetLastError 7918->7920 7919->7917 7921 aa9ea6 FreeLibrary 7919->7921 7920->7922 7921->7917 7922->7917 7922->7918 7923 aa9e79 LoadLibraryExW 7922->7923 7923->7919 7923->7922 7925 aa9eb1 ___vcrt_FlsGetValue 5 API calls 7924->7925 7926 aa9f14 7925->7926 7927 aa9f2d TlsAlloc 7926->7927 7928 aa9bce 7926->7928 7928->7896 7929 aa9fab 7928->7929 7930 aa9eb1 ___vcrt_FlsGetValue 5 API calls 7929->7930 7931 aa9fc5 7930->7931 7932 aa9fe0 TlsSetValue 7931->7932 7933 aa9be7 7931->7933 7932->7933 7933->7899 7934 aa9bf7 7933->7934 7935 aa9c07 7934->7935 7936 aa9c01 7934->7936 7935->7896 7938 aa9f35 7936->7938 7939 aa9eb1 ___vcrt_FlsGetValue 5 API calls 7938->7939 7940 aa9f4f 7939->7940 7941 aa9f67 TlsFree 7940->7941 7942 aa9f5b 7940->7942 7941->7942 7942->7935 7944 aa7cde GetStartupInfoW 7943->7944 7944->7832 7946 aa6dd7 56 API calls 7945->7946 7947 aa6898 7946->7947 7948 aa68b1 GetModuleFileNameW 7947->7948 7949 aa68c9 7948->7949 7950 aa69a0 7949->7950 8008 aa664f 7949->8008 7950->7836 7952 aa69e3 7954 aa6906 8038 aa6f7d 7954->8038 7957 aa6914 8047 aa6eab 7957->8047 7958 aa6912 8023 aa6cc6 7958->8023 7960 aa6931 8027 aa6ffa 7960->8027 7962 aa693c 8031 aa6d76 7962->8031 7964 aa694e 7965 aa6dd7 56 API calls 7964->7965 7966 aa695e 7965->7966 7967 aa6973 SHGetFolderPathW 7966->7967 7968 aa698c 7967->7968 7968->7950 8060 aa6d3c 7968->8060 7970 aa6998 7971 aa6d3c CharLowerBuffW 7970->7971 7971->7950 7973 aa664f 56 API calls 7972->7973 7974 aa6ddf 7973->7974 7974->7838 7976 aa6ac1 __FrameHandler3::FrameUnwindToState 7975->7976 7977 aa6ad0 GetModuleFileNameW 7976->7977 7978 aa6aeb 7977->7978 7979 aa6af5 PathRemoveFileSpecW 7977->7979 7980 aa6820 GetLastError 7978->7980 8284 aab6ca 7979->8284 8002 aa6af0 7980->8002 7983 aa6b31 8293 aa683b 7983->8293 7986 aa6c1c 7986->7841 7986->7848 7988 aa6b63 7990 aab6ca 41 API calls 7988->7990 7989 aa6b40 7993 aa6eab 41 API calls 7989->7993 7991 aa6b7b 7990->7991 7992 aa6dd7 56 API calls 7991->7992 7994 aa6b89 7992->7994 7993->8002 8299 aa69ee RegOpenKeyExW 7994->8299 7996 aa6b9a 7997 aa6ba0 PathAppendW 7996->7997 7996->8002 7998 aa6bb3 PathAppendW 7997->7998 7999 aa6bc5 7997->7999 7998->7999 8000 aa6bce 7998->8000 8001 aa6820 GetLastError 7999->8001 8003 aa683b 6 API calls 8000->8003 8001->8002 8277 aa73ee 8002->8277 8004 aa6bd9 8003->8004 8004->8002 8005 aa6eab 41 API calls 8004->8005 8005->8002 8007 aa682a 8006->8007 8007->7848 8009 aa667d 8008->8009 8020 aa6666 8008->8020 8065 aa750b EnterCriticalSection 8009->8065 8011 aa750b 6 API calls 8014 aa66cd 8011->8014 8012 aa6688 8013 aa6692 GetProcessHeap 8012->8013 8012->8020 8070 aa781d 8013->8070 8017 aa781d 44 API calls 8014->8017 8022 aa6678 8014->8022 8019 aa671a 8017->8019 8021 aa74c1 __Init_thread_footer 5 API calls 8019->8021 8020->8011 8020->8022 8021->8022 8022->7952 8022->7954 8022->7957 8146 aa6dfe 8023->8146 8025 aa6cd4 PathRemoveFileSpecW 8026 aa6ce3 8025->8026 8026->7960 8028 aa7005 8027->8028 8029 aa7013 8028->8029 8148 aa70a4 8028->8148 8029->7962 8032 aa6d8e 8031->8032 8037 aa6da2 8031->8037 8033 aa6dc3 8032->8033 8034 aa6d9d 8032->8034 8035 aa6eab 41 API calls 8033->8035 8036 aa6ffa 14 API calls 8034->8036 8035->8037 8036->8037 8037->7964 8154 aa7387 EnterCriticalSection 8038->8154 8040 aa6fa8 FindResourceExW 8044 aa6f92 8040->8044 8041 aa6fef 8041->7958 8043 aa7387 5 API calls 8043->8044 8044->8040 8044->8041 8044->8043 8045 aa6fe0 8044->8045 8159 aa6539 LoadResource 8044->8159 8045->8041 8163 aa7118 FindResourceW 8045->8163 8048 aa6eb9 __InternalCxxFrameHandler 8047->8048 8050 aa6ec3 8047->8050 8048->7958 8049 aa6f57 8050->8049 8051 aa6f3d 8050->8051 8052 aa6ef3 8050->8052 8053 aa70a4 14 API calls 8051->8053 8052->8048 8054 aa6f04 8052->8054 8056 aa6f1a 8052->8056 8053->8048 8055 aabaf8 ___free_lconv_mon 14 API calls 8054->8055 8057 aa6f09 8055->8057 8056->8048 8058 aabaf8 ___free_lconv_mon 14 API calls 8056->8058 8059 aaba3a ___std_exception_copy 41 API calls 8057->8059 8058->8057 8059->8048 8061 aa6d4b 8060->8061 8062 aa6d6b 8061->8062 8063 aa6d56 CharLowerBuffW 8061->8063 8064 aa6d66 8063->8064 8064->7970 8066 aa751f 8065->8066 8067 aa7524 LeaveCriticalSection 8066->8067 8078 aa7593 8066->8078 8067->8012 8083 aa77f0 8070->8083 8073 aa74c1 EnterCriticalSection LeaveCriticalSection 8074 aa755d 8073->8074 8075 aa7568 RtlWakeAllConditionVariable 8074->8075 8076 aa7579 SetEvent ResetEvent 8074->8076 8075->8020 8076->8020 8079 aa75ba LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 8078->8079 8080 aa75a1 SleepConditionVariableCS 8078->8080 8081 aa75de 8079->8081 8080->8081 8081->8066 8084 aa77ff 8083->8084 8085 aa7806 8083->8085 8089 aac80d 8084->8089 8092 aac88a 8085->8092 8088 aa66b8 8088->8073 8090 aac88a 44 API calls 8089->8090 8091 aac81f 8090->8091 8091->8088 8095 aac5d6 8092->8095 8096 aac5e2 ___scrt_is_nonwritable_in_current_image 8095->8096 8103 aad642 EnterCriticalSection 8096->8103 8098 aac5f0 8104 aac631 8098->8104 8100 aac5fd 8114 aac625 8100->8114 8103->8098 8105 aac64c 8104->8105 8106 aac6bf _unexpected 8104->8106 8105->8106 8107 aac69f 8105->8107 8117 aabb26 8105->8117 8106->8100 8107->8106 8109 aabb26 44 API calls 8107->8109 8111 aac6b5 8109->8111 8110 aac695 8112 aad52b ___free_lconv_mon 14 API calls 8110->8112 8113 aad52b ___free_lconv_mon 14 API calls 8111->8113 8112->8107 8113->8106 8145 aad68a LeaveCriticalSection 8114->8145 8116 aac60e 8116->8088 8118 aabb4e 8117->8118 8119 aabb33 8117->8119 8122 aabb5d 8118->8122 8126 aad565 8118->8126 8119->8118 8120 aabb3f 8119->8120 8123 aabaf8 ___free_lconv_mon 14 API calls 8120->8123 8133 aad598 8122->8133 8125 aabb44 __FrameHandler3::FrameUnwindToState 8123->8125 8125->8110 8127 aad570 8126->8127 8128 aad585 HeapSize 8126->8128 8129 aabaf8 ___free_lconv_mon 14 API calls 8127->8129 8128->8122 8130 aad575 8129->8130 8131 aaba3a ___std_exception_copy 41 API calls 8130->8131 8132 aad580 8131->8132 8132->8122 8134 aad5b0 8133->8134 8135 aad5a5 8133->8135 8137 aad5b8 8134->8137 8144 aad5c1 _unexpected 8134->8144 8136 aafac8 15 API calls 8135->8136 8142 aad5ad 8136->8142 8138 aad52b ___free_lconv_mon 14 API calls 8137->8138 8138->8142 8139 aad5eb HeapReAlloc 8139->8142 8139->8144 8140 aad5c6 8141 aabaf8 ___free_lconv_mon 14 API calls 8140->8141 8141->8142 8142->8125 8143 aaed5b _unexpected EnterCriticalSection LeaveCriticalSection 8143->8144 8144->8139 8144->8140 8144->8143 8145->8116 8147 aa6e2f 8146->8147 8149 aa70b6 8148->8149 8151 aa70d9 __InternalCxxFrameHandler 8148->8151 8150 aabaf8 ___free_lconv_mon 14 API calls 8149->8150 8152 aa70bf __FrameHandler3::FrameUnwindToState 8149->8152 8150->8152 8151->8029 8152->8151 8153 aabaf8 14 API calls ___free_lconv_mon 8152->8153 8153->8152 8155 aa73a9 LeaveCriticalSection 8154->8155 8156 aa73a0 8154->8156 8155->8044 8156->8155 8169 aa7362 8156->8169 8160 aa654f LockResource 8159->8160 8162 aa656f 8159->8162 8161 aa655c SizeofResource 8160->8161 8160->8162 8161->8162 8162->8044 8164 aa7139 8163->8164 8165 aa7168 8163->8165 8166 aa6539 3 API calls 8164->8166 8165->8041 8167 aa7146 8166->8167 8167->8165 8180 aab61a 8167->8180 8170 aa736c 8169->8170 8172 aa7371 8170->8172 8179 aa64a0 RaiseException 8170->8179 8172->8155 8173 aa7386 EnterCriticalSection 8175 aa73a0 8173->8175 8177 aa73a9 LeaveCriticalSection 8173->8177 8175->8177 8178 aa7362 RaiseException 8175->8178 8177->8155 8178->8177 8179->8173 8181 aab62b 8180->8181 8185 aab627 __InternalCxxFrameHandler 8180->8185 8182 aab632 8181->8182 8187 aab645 _wmemset 8181->8187 8183 aabaf8 ___free_lconv_mon 14 API calls 8182->8183 8184 aab637 8183->8184 8194 aaba3a 8184->8194 8185->8165 8187->8185 8188 aab67f 8187->8188 8189 aab676 8187->8189 8188->8185 8191 aabaf8 ___free_lconv_mon 14 API calls 8188->8191 8190 aabaf8 ___free_lconv_mon 14 API calls 8189->8190 8192 aab67b 8190->8192 8191->8192 8193 aaba3a ___std_exception_copy 41 API calls 8192->8193 8193->8185 8197 aab986 8194->8197 8198 aab998 ___std_exception_copy 8197->8198 8203 aab9bd 8198->8203 8200 aab9b0 8214 aab776 8200->8214 8204 aab9d4 8203->8204 8205 aab9cd 8203->8205 8208 aab9e2 8204->8208 8224 aab7b2 8204->8224 8220 aab7db GetLastError 8205->8220 8208->8200 8209 aaba09 8209->8208 8227 aaba4a IsProcessorFeaturePresent 8209->8227 8211 aaba39 8212 aab986 ___std_exception_copy 41 API calls 8211->8212 8213 aaba46 8212->8213 8213->8200 8215 aab782 8214->8215 8216 aab799 8215->8216 8259 aab821 8215->8259 8218 aab821 ___std_exception_copy 41 API calls 8216->8218 8219 aab7ac 8216->8219 8218->8219 8219->8185 8221 aab7f4 8220->8221 8231 aad442 8221->8231 8225 aab7bd GetLastError SetLastError 8224->8225 8226 aab7d6 8224->8226 8225->8209 8226->8209 8228 aaba56 8227->8228 8253 aab83e 8228->8253 8232 aad455 8231->8232 8237 aad45b 8231->8237 8234 aae902 _unexpected 6 API calls 8232->8234 8233 aae941 _unexpected 6 API calls 8235 aad475 8233->8235 8234->8237 8236 aab80c SetLastError 8235->8236 8238 aad6d2 _unexpected 14 API calls 8235->8238 8236->8204 8237->8233 8237->8236 8239 aad485 8238->8239 8240 aad48d 8239->8240 8241 aad4a2 8239->8241 8242 aae941 _unexpected 6 API calls 8240->8242 8243 aae941 _unexpected 6 API calls 8241->8243 8244 aad499 8242->8244 8245 aad4ae 8243->8245 8250 aad52b ___free_lconv_mon 14 API calls 8244->8250 8246 aad4b2 8245->8246 8247 aad4c1 8245->8247 8248 aae941 _unexpected 6 API calls 8246->8248 8249 aad06e _unexpected 14 API calls 8247->8249 8248->8244 8251 aad4cc 8249->8251 8250->8236 8252 aad52b ___free_lconv_mon 14 API calls 8251->8252 8252->8236 8254 aab85a __FrameHandler3::FrameUnwindToState 8253->8254 8255 aab886 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 8254->8255 8256 aab957 __FrameHandler3::FrameUnwindToState 8255->8256 8257 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 8256->8257 8258 aab975 GetCurrentProcess TerminateProcess 8257->8258 8258->8211 8260 aab82b 8259->8260 8261 aab834 8259->8261 8262 aab7db ___std_exception_copy 16 API calls 8260->8262 8261->8216 8263 aab830 8262->8263 8263->8261 8266 aacd36 8263->8266 8267 aaeeb2 __FrameHandler3::FrameUnwindToState EnterCriticalSection LeaveCriticalSection 8266->8267 8268 aacd3b 8267->8268 8269 aacd46 8268->8269 8270 aaeef7 __FrameHandler3::FrameUnwindToState 40 API calls 8268->8270 8271 aacd6f 8269->8271 8272 aacd50 IsProcessorFeaturePresent 8269->8272 8270->8269 8273 aabfc9 __FrameHandler3::FrameUnwindToState 23 API calls 8271->8273 8274 aacd5c 8272->8274 8276 aacd79 8273->8276 8275 aab83e __FrameHandler3::FrameUnwindToState 8 API calls 8274->8275 8275->8271 8278 aa73f6 8277->8278 8279 aa73f7 IsProcessorFeaturePresent 8277->8279 8278->7986 8281 aa7acb 8279->8281 8303 aa7a8e SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 8281->8303 8283 aa7bae 8283->7986 8285 aab6e6 8284->8285 8286 aab6d8 8284->8286 8287 aabaf8 ___free_lconv_mon 14 API calls 8285->8287 8286->8285 8291 aab700 8286->8291 8288 aab6f0 8287->8288 8289 aaba3a ___std_exception_copy 41 API calls 8288->8289 8290 aa6b16 PathAppendW 8289->8290 8290->7978 8290->7983 8291->8290 8292 aabaf8 ___free_lconv_mon 14 API calls 8291->8292 8292->8288 8294 aa6878 8293->8294 8295 aa6852 8293->8295 8297 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 8294->8297 8295->8294 8296 aa6859 GetFileAttributesExW 8295->8296 8296->8294 8298 aa6885 8297->8298 8298->7988 8298->7989 8300 aa6a2b 8299->8300 8302 aa6a1f 8299->8302 8301 aa6a43 SHQueryValueExW 8300->8301 8301->8302 8302->7996 8303->8283 8305 aad256 8304->8305 8308 aad25c 8304->8308 8306 aae902 _unexpected 6 API calls 8305->8306 8306->8308 8307 aae941 _unexpected 6 API calls 8309 aad278 8307->8309 8308->8307 8328 aad260 SetLastError 8308->8328 8311 aad6d2 _unexpected 14 API calls 8309->8311 8309->8328 8312 aad28d 8311->8312 8316 aad2a6 8312->8316 8317 aad295 8312->8317 8313 aaccac 8313->7855 8314 aad2f5 8315 aacd36 __FrameHandler3::FrameUnwindToState 39 API calls 8314->8315 8318 aad2fa 8315->8318 8320 aae941 _unexpected 6 API calls 8316->8320 8319 aae941 _unexpected 6 API calls 8317->8319 8322 aad2a3 8319->8322 8321 aad2b2 8320->8321 8323 aad2cd 8321->8323 8324 aad2b6 8321->8324 8326 aad52b ___free_lconv_mon 14 API calls 8322->8326 8327 aad06e _unexpected 14 API calls 8323->8327 8325 aae941 _unexpected 6 API calls 8324->8325 8325->8322 8326->8328 8329 aad2d8 8327->8329 8328->8313 8328->8314 8330 aad52b ___free_lconv_mon 14 API calls 8329->8330 8330->8328 8332 aac9e7 ___scrt_uninitialize_crt 8331->8332 8333 aac9d5 8331->8333 8332->7865 8334 aac9e3 8333->8334 8336 aaf395 8333->8336 8334->7865 8339 aaf222 8336->8339 8342 aaf176 8339->8342 8343 aaf182 ___scrt_is_nonwritable_in_current_image 8342->8343 8350 aad642 EnterCriticalSection 8343->8350 8345 aaf1f8 8359 aaf216 8345->8359 8348 aaf18c ___scrt_uninitialize_crt 8348->8345 8351 aaf0ea 8348->8351 8350->8348 8352 aaf0f6 ___scrt_is_nonwritable_in_current_image 8351->8352 8362 aaf4b2 EnterCriticalSection 8352->8362 8354 aaf100 ___scrt_uninitialize_crt 8355 aaf14c 8354->8355 8363 aaf330 8354->8363 8376 aaf16a 8355->8376 8478 aad68a LeaveCriticalSection 8359->8478 8361 aaf204 8361->8334 8362->8354 8364 aaf345 ___std_exception_copy 8363->8364 8365 aaf34c 8364->8365 8366 aaf357 8364->8366 8367 aaf222 ___scrt_uninitialize_crt 70 API calls 8365->8367 8379 aaf2c7 8366->8379 8369 aaf352 8367->8369 8370 aab776 ___std_exception_copy 41 API calls 8369->8370 8372 aaf38f 8370->8372 8372->8355 8374 aaf378 8392 ab0f24 8374->8392 8477 aaf4c6 LeaveCriticalSection 8376->8477 8378 aaf158 8378->8348 8380 aaf2e0 8379->8380 8384 aaf307 8379->8384 8381 ab065c ___scrt_uninitialize_crt 41 API calls 8380->8381 8380->8384 8382 aaf2fc 8381->8382 8403 ab174f 8382->8403 8384->8369 8385 ab065c 8384->8385 8386 ab0668 8385->8386 8387 ab067d 8385->8387 8388 aabaf8 ___free_lconv_mon 14 API calls 8386->8388 8387->8374 8389 ab066d 8388->8389 8390 aaba3a ___std_exception_copy 41 API calls 8389->8390 8391 ab0678 8390->8391 8391->8374 8393 ab0f35 8392->8393 8396 ab0f42 8392->8396 8394 aabaf8 ___free_lconv_mon 14 API calls 8393->8394 8402 ab0f3a 8394->8402 8395 ab0f8b 8397 aabaf8 ___free_lconv_mon 14 API calls 8395->8397 8396->8395 8398 ab0f69 8396->8398 8399 ab0f90 8397->8399 8444 ab0e82 8398->8444 8401 aaba3a ___std_exception_copy 41 API calls 8399->8401 8401->8402 8402->8369 8406 ab175b ___scrt_is_nonwritable_in_current_image 8403->8406 8404 ab1763 8404->8384 8405 ab181f 8407 aab9bd ___std_exception_copy 41 API calls 8405->8407 8406->8404 8406->8405 8408 ab17b0 8406->8408 8407->8404 8414 aaf701 EnterCriticalSection 8408->8414 8410 ab17b6 8412 ab17d3 8410->8412 8415 ab1857 8410->8415 8441 ab1817 8412->8441 8414->8410 8416 ab187c 8415->8416 8438 ab189f ___scrt_uninitialize_crt 8415->8438 8417 ab1880 8416->8417 8419 ab18de 8416->8419 8418 aab9bd ___std_exception_copy 41 API calls 8417->8418 8418->8438 8420 ab18f5 8419->8420 8421 ab1f2e ___scrt_uninitialize_crt 43 API calls 8419->8421 8422 ab13db ___scrt_uninitialize_crt 42 API calls 8420->8422 8421->8420 8423 ab18ff 8422->8423 8424 ab1945 8423->8424 8425 ab1905 8423->8425 8426 ab1959 8424->8426 8427 ab19a8 WriteFile 8424->8427 8428 ab192f 8425->8428 8429 ab190c 8425->8429 8432 ab1961 8426->8432 8433 ab1996 8426->8433 8430 ab19ca GetLastError 8427->8430 8427->8438 8431 ab0fa1 ___scrt_uninitialize_crt 47 API calls 8428->8431 8437 ab1373 ___scrt_uninitialize_crt 6 API calls 8429->8437 8429->8438 8430->8438 8431->8438 8435 ab1966 8432->8435 8436 ab1984 8432->8436 8434 ab1459 ___scrt_uninitialize_crt 7 API calls 8433->8434 8434->8438 8435->8438 8440 ab1534 ___scrt_uninitialize_crt 7 API calls 8435->8440 8439 ab161d ___scrt_uninitialize_crt 8 API calls 8436->8439 8437->8438 8438->8412 8439->8438 8440->8438 8442 aaf724 ___scrt_uninitialize_crt LeaveCriticalSection 8441->8442 8443 ab181d 8442->8443 8443->8404 8445 ab0e8e ___scrt_is_nonwritable_in_current_image 8444->8445 8457 aaf701 EnterCriticalSection 8445->8457 8447 ab0e9d 8448 ab0ee2 8447->8448 8458 aaf7d8 8447->8458 8450 aabaf8 ___free_lconv_mon 14 API calls 8448->8450 8452 ab0ee9 8450->8452 8451 ab0ec9 FlushFileBuffers 8451->8452 8453 ab0ed5 GetLastError 8451->8453 8474 ab0f18 8452->8474 8471 aabae5 8453->8471 8457->8447 8459 aaf7fa 8458->8459 8460 aaf7e5 8458->8460 8462 aabae5 ___scrt_uninitialize_crt 14 API calls 8459->8462 8466 aaf81f 8459->8466 8461 aabae5 ___scrt_uninitialize_crt 14 API calls 8460->8461 8463 aaf7ea 8461->8463 8464 aaf82a 8462->8464 8465 aabaf8 ___free_lconv_mon 14 API calls 8463->8465 8467 aabaf8 ___free_lconv_mon 14 API calls 8464->8467 8469 aaf7f2 8465->8469 8466->8451 8468 aaf832 8467->8468 8470 aaba3a ___std_exception_copy 41 API calls 8468->8470 8469->8451 8470->8469 8472 aad391 ___free_lconv_mon 14 API calls 8471->8472 8473 aabaea 8472->8473 8473->8448 8475 aaf724 ___scrt_uninitialize_crt LeaveCriticalSection 8474->8475 8476 ab0f01 8475->8476 8476->8402 8477->8378 8478->8361 7594 aad391 GetLastError 7595 aad3ad 7594->7595 7596 aad3a7 7594->7596 7600 aad3b1 SetLastError 7595->7600 7617 aae941 7595->7617 7629 aae902 7596->7629 7604 aad3e6 7607 aae941 _unexpected 6 API calls 7604->7607 7605 aad3f7 7606 aae941 _unexpected 6 API calls 7605->7606 7609 aad403 7606->7609 7608 aad3f4 7607->7608 7613 aad52b ___free_lconv_mon 12 API calls 7608->7613 7610 aad41e 7609->7610 7611 aad407 7609->7611 7634 aad06e 7610->7634 7612 aae941 _unexpected 6 API calls 7611->7612 7612->7608 7613->7600 7616 aad52b ___free_lconv_mon 12 API calls 7616->7600 7618 aae7c1 _unexpected 5 API calls 7617->7618 7619 aae95d 7618->7619 7620 aae97b TlsSetValue 7619->7620 7621 aad3c9 7619->7621 7621->7600 7622 aad6d2 7621->7622 7627 aad6df _unexpected 7622->7627 7623 aad71f 7626 aabaf8 ___free_lconv_mon 13 API calls 7623->7626 7624 aad70a RtlAllocateHeap 7625 aad3de 7624->7625 7624->7627 7625->7604 7625->7605 7626->7625 7627->7623 7627->7624 7639 aaed5b 7627->7639 7630 aae7c1 _unexpected 5 API calls 7629->7630 7631 aae91e 7630->7631 7632 aae939 TlsGetValue 7631->7632 7633 aae927 7631->7633 7633->7595 7653 aacf02 7634->7653 7642 aaed88 7639->7642 7643 aaed94 ___scrt_is_nonwritable_in_current_image 7642->7643 7648 aad642 EnterCriticalSection 7643->7648 7645 aaed9f 7649 aaeddb 7645->7649 7648->7645 7652 aad68a LeaveCriticalSection 7649->7652 7651 aaed66 7651->7627 7652->7651 7654 aacf0e ___scrt_is_nonwritable_in_current_image 7653->7654 7667 aad642 EnterCriticalSection 7654->7667 7656 aacf18 7668 aacf48 7656->7668 7659 aad014 7660 aad020 ___scrt_is_nonwritable_in_current_image 7659->7660 7672 aad642 EnterCriticalSection 7660->7672 7662 aad02a 7673 aad1f5 7662->7673 7664 aad042 7677 aad062 7664->7677 7667->7656 7671 aad68a LeaveCriticalSection 7668->7671 7670 aacf36 7670->7659 7671->7670 7672->7662 7674 aad22b _unexpected 7673->7674 7675 aad204 _unexpected 7673->7675 7674->7664 7675->7674 7680 aafd0a 7675->7680 7794 aad68a LeaveCriticalSection 7677->7794 7679 aad050 7679->7616 7681 aafd8a 7680->7681 7684 aafd20 7680->7684 7683 aad52b ___free_lconv_mon 14 API calls 7681->7683 7706 aafdd8 7681->7706 7685 aafdac 7683->7685 7684->7681 7687 aad52b ___free_lconv_mon 14 API calls 7684->7687 7688 aafd53 7684->7688 7686 aad52b ___free_lconv_mon 14 API calls 7685->7686 7689 aafdbf 7686->7689 7692 aafd48 7687->7692 7693 aad52b ___free_lconv_mon 14 API calls 7688->7693 7705 aafd75 7688->7705 7694 aad52b ___free_lconv_mon 14 API calls 7689->7694 7690 aad52b ___free_lconv_mon 14 API calls 7695 aafd7f 7690->7695 7691 aafe46 7697 aad52b ___free_lconv_mon 14 API calls 7691->7697 7708 aaf858 7692->7708 7699 aafd6a 7693->7699 7700 aafdcd 7694->7700 7696 aad52b ___free_lconv_mon 14 API calls 7695->7696 7696->7681 7701 aafe4c 7697->7701 7736 aaf956 7699->7736 7703 aad52b ___free_lconv_mon 14 API calls 7700->7703 7701->7674 7703->7706 7704 aad52b 14 API calls ___free_lconv_mon 7707 aafde6 7704->7707 7705->7690 7748 aafe7b 7706->7748 7707->7691 7707->7704 7709 aaf869 7708->7709 7735 aaf952 7708->7735 7710 aaf87a 7709->7710 7711 aad52b ___free_lconv_mon 14 API calls 7709->7711 7712 aaf88c 7710->7712 7713 aad52b ___free_lconv_mon 14 API calls 7710->7713 7711->7710 7714 aaf89e 7712->7714 7716 aad52b ___free_lconv_mon 14 API calls 7712->7716 7713->7712 7715 aaf8b0 7714->7715 7717 aad52b ___free_lconv_mon 14 API calls 7714->7717 7718 aaf8c2 7715->7718 7719 aad52b ___free_lconv_mon 14 API calls 7715->7719 7716->7714 7717->7715 7720 aaf8d4 7718->7720 7721 aad52b ___free_lconv_mon 14 API calls 7718->7721 7719->7718 7722 aad52b ___free_lconv_mon 14 API calls 7720->7722 7726 aaf8e6 7720->7726 7721->7720 7722->7726 7723 aad52b ___free_lconv_mon 14 API calls 7725 aaf8f8 7723->7725 7724 aaf90a 7728 aaf91c 7724->7728 7729 aad52b ___free_lconv_mon 14 API calls 7724->7729 7725->7724 7727 aad52b ___free_lconv_mon 14 API calls 7725->7727 7726->7723 7726->7725 7727->7724 7730 aaf92e 7728->7730 7732 aad52b ___free_lconv_mon 14 API calls 7728->7732 7729->7728 7731 aaf940 7730->7731 7733 aad52b ___free_lconv_mon 14 API calls 7730->7733 7734 aad52b ___free_lconv_mon 14 API calls 7731->7734 7731->7735 7732->7730 7733->7731 7734->7735 7735->7688 7737 aaf963 7736->7737 7747 aaf9bb 7736->7747 7738 aaf973 7737->7738 7739 aad52b ___free_lconv_mon 14 API calls 7737->7739 7740 aad52b ___free_lconv_mon 14 API calls 7738->7740 7744 aaf985 7738->7744 7739->7738 7740->7744 7741 aad52b ___free_lconv_mon 14 API calls 7743 aaf997 7741->7743 7742 aaf9a9 7746 aad52b ___free_lconv_mon 14 API calls 7742->7746 7742->7747 7743->7742 7745 aad52b ___free_lconv_mon 14 API calls 7743->7745 7744->7741 7744->7743 7745->7742 7746->7747 7747->7705 7749 aafe88 7748->7749 7753 aafea7 7748->7753 7749->7753 7754 aaf9e4 7749->7754 7752 aad52b ___free_lconv_mon 14 API calls 7752->7753 7753->7707 7755 aaf9f5 7754->7755 7789 aafac2 7754->7789 7790 aaf9bf 7755->7790 7758 aaf9bf _unexpected 14 API calls 7759 aafa08 7758->7759 7760 aaf9bf _unexpected 14 API calls 7759->7760 7761 aafa13 7760->7761 7762 aaf9bf _unexpected 14 API calls 7761->7762 7763 aafa1e 7762->7763 7764 aaf9bf _unexpected 14 API calls 7763->7764 7765 aafa2c 7764->7765 7766 aad52b ___free_lconv_mon 14 API calls 7765->7766 7767 aafa37 7766->7767 7768 aad52b ___free_lconv_mon 14 API calls 7767->7768 7769 aafa42 7768->7769 7770 aad52b ___free_lconv_mon 14 API calls 7769->7770 7771 aafa4d 7770->7771 7772 aaf9bf _unexpected 14 API calls 7771->7772 7773 aafa5b 7772->7773 7774 aaf9bf _unexpected 14 API calls 7773->7774 7775 aafa69 7774->7775 7776 aaf9bf _unexpected 14 API calls 7775->7776 7777 aafa7a 7776->7777 7778 aaf9bf _unexpected 14 API calls 7777->7778 7779 aafa88 7778->7779 7780 aaf9bf _unexpected 14 API calls 7779->7780 7781 aafa96 7780->7781 7782 aad52b ___free_lconv_mon 14 API calls 7781->7782 7783 aafaa1 7782->7783 7784 aad52b ___free_lconv_mon 14 API calls 7783->7784 7785 aafaac 7784->7785 7786 aad52b ___free_lconv_mon 14 API calls 7785->7786 7787 aafab7 7786->7787 7788 aad52b ___free_lconv_mon 14 API calls 7787->7788 7788->7789 7789->7752 7791 aaf9d1 7790->7791 7792 aaf9e0 7791->7792 7793 aad52b ___free_lconv_mon 14 API calls 7791->7793 7792->7758 7793->7791 7794->7679 9690 aaf466 9691 aaf395 ___scrt_uninitialize_crt 70 API calls 9690->9691 9692 aaf46e 9691->9692 9700 ab1a57 9692->9700 9694 aaf473 9710 ab1b02 9694->9710 9697 aaf49d 9698 aad52b ___free_lconv_mon 14 API calls 9697->9698 9699 aaf4a8 9698->9699 9701 ab1a63 ___scrt_is_nonwritable_in_current_image 9700->9701 9714 aad642 EnterCriticalSection 9701->9714 9703 ab1ada 9721 ab1af9 9703->9721 9704 ab1a6e 9704->9703 9706 ab1aae DeleteCriticalSection 9704->9706 9715 ab20a3 9704->9715 9709 aad52b ___free_lconv_mon 14 API calls 9706->9709 9709->9704 9711 ab1b19 9710->9711 9713 aaf482 DeleteCriticalSection 9710->9713 9712 aad52b ___free_lconv_mon 14 API calls 9711->9712 9711->9713 9712->9713 9713->9694 9713->9697 9714->9704 9716 ab20b6 ___std_exception_copy 9715->9716 9724 ab1f7e 9716->9724 9718 ab20c2 9719 aab776 ___std_exception_copy 41 API calls 9718->9719 9720 ab20ce 9719->9720 9720->9704 9796 aad68a LeaveCriticalSection 9721->9796 9723 ab1ae6 9723->9694 9725 ab1f8a ___scrt_is_nonwritable_in_current_image 9724->9725 9726 ab1fb7 9725->9726 9727 ab1f94 9725->9727 9734 ab1faf 9726->9734 9735 aaf4b2 EnterCriticalSection 9726->9735 9728 aab9bd ___std_exception_copy 41 API calls 9727->9728 9728->9734 9730 ab1fd5 9736 ab2015 9730->9736 9732 ab1fe2 9750 ab200d 9732->9750 9734->9718 9735->9730 9737 ab2022 9736->9737 9738 ab2045 9736->9738 9739 aab9bd ___std_exception_copy 41 API calls 9737->9739 9740 ab203d 9738->9740 9741 aaf2c7 ___scrt_uninitialize_crt 66 API calls 9738->9741 9739->9740 9740->9732 9742 ab205d 9741->9742 9743 ab1b02 14 API calls 9742->9743 9744 ab2065 9743->9744 9745 ab065c ___scrt_uninitialize_crt 41 API calls 9744->9745 9746 ab2071 9745->9746 9753 ab289c 9746->9753 9749 aad52b ___free_lconv_mon 14 API calls 9749->9740 9795 aaf4c6 LeaveCriticalSection 9750->9795 9752 ab2013 9752->9734 9754 ab2078 9753->9754 9755 ab28c5 9753->9755 9754->9740 9754->9749 9756 ab2914 9755->9756 9758 ab28ec 9755->9758 9757 aab9bd ___std_exception_copy 41 API calls 9756->9757 9757->9754 9760 ab280b 9758->9760 9761 ab2817 ___scrt_is_nonwritable_in_current_image 9760->9761 9768 aaf701 EnterCriticalSection 9761->9768 9763 ab2825 9764 ab2856 9763->9764 9769 ab293f 9763->9769 9782 ab2890 9764->9782 9768->9763 9770 aaf7d8 ___scrt_uninitialize_crt 41 API calls 9769->9770 9773 ab294f 9770->9773 9771 ab2955 9785 aaf747 9771->9785 9773->9771 9774 ab2987 9773->9774 9776 aaf7d8 ___scrt_uninitialize_crt 41 API calls 9773->9776 9774->9771 9775 aaf7d8 ___scrt_uninitialize_crt 41 API calls 9774->9775 9778 ab2993 CloseHandle 9775->9778 9777 ab297e 9776->9777 9779 aaf7d8 ___scrt_uninitialize_crt 41 API calls 9777->9779 9778->9771 9780 ab299f GetLastError 9778->9780 9779->9774 9780->9771 9781 ab29ad ___scrt_uninitialize_crt 9781->9764 9794 aaf724 LeaveCriticalSection 9782->9794 9784 ab2879 9784->9754 9786 aaf7bd 9785->9786 9789 aaf756 9785->9789 9787 aabaf8 ___free_lconv_mon 14 API calls 9786->9787 9788 aaf7c2 9787->9788 9790 aabae5 ___scrt_uninitialize_crt 14 API calls 9788->9790 9789->9786 9793 aaf780 9789->9793 9791 aaf7ad 9790->9791 9791->9781 9792 aaf7a7 SetStdHandle 9792->9791 9793->9791 9793->9792 9794->9784 9795->9752 9796->9723 9122 ab0df7 9125 aae20d 9122->9125 9126 aae248 9125->9126 9127 aae216 9125->9127 9131 aad2fb 9127->9131 9132 aad30c 9131->9132 9133 aad306 9131->9133 9134 aae941 _unexpected 6 API calls 9132->9134 9154 aad312 9132->9154 9135 aae902 _unexpected 6 API calls 9133->9135 9136 aad326 9134->9136 9135->9132 9137 aad6d2 _unexpected 14 API calls 9136->9137 9136->9154 9140 aad336 9137->9140 9138 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 9141 aad390 9138->9141 9139 aad317 9156 aae018 9139->9156 9142 aad33e 9140->9142 9143 aad353 9140->9143 9145 aae941 _unexpected 6 API calls 9142->9145 9144 aae941 _unexpected 6 API calls 9143->9144 9146 aad35f 9144->9146 9147 aad34a 9145->9147 9148 aad372 9146->9148 9149 aad363 9146->9149 9152 aad52b ___free_lconv_mon 14 API calls 9147->9152 9151 aad06e _unexpected 14 API calls 9148->9151 9150 aae941 _unexpected 6 API calls 9149->9150 9150->9147 9153 aad37d 9151->9153 9152->9154 9155 aad52b ___free_lconv_mon 14 API calls 9153->9155 9154->9138 9154->9139 9155->9139 9179 aae16d 9156->9179 9162 aae06c 9163 aae082 9162->9163 9164 aae074 9162->9164 9204 aae268 9163->9204 9166 aad52b ___free_lconv_mon 14 API calls 9164->9166 9167 aae05b 9166->9167 9167->9126 9169 aae0ba 9170 aabaf8 ___free_lconv_mon 14 API calls 9169->9170 9171 aae0bf 9170->9171 9174 aad52b ___free_lconv_mon 14 API calls 9171->9174 9172 aae101 9173 aae14a 9172->9173 9215 aadc8a 9172->9215 9177 aad52b ___free_lconv_mon 14 API calls 9173->9177 9174->9167 9175 aae0d5 9175->9172 9178 aad52b ___free_lconv_mon 14 API calls 9175->9178 9177->9167 9178->9172 9180 aae179 ___scrt_is_nonwritable_in_current_image 9179->9180 9182 aae193 9180->9182 9223 aad642 EnterCriticalSection 9180->9223 9184 aae042 9182->9184 9185 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 9182->9185 9183 aae1a3 9188 aad52b ___free_lconv_mon 14 API calls 9183->9188 9189 aae1cf 9183->9189 9190 aadd98 9184->9190 9187 aae20c 9185->9187 9188->9189 9224 aae1ec 9189->9224 9228 aadb29 9190->9228 9193 aaddcb 9195 aaddd0 GetACP 9193->9195 9196 aadde2 9193->9196 9194 aaddb9 GetOEMCP 9194->9196 9195->9196 9196->9167 9197 aafac8 9196->9197 9198 aafb06 9197->9198 9202 aafad6 _unexpected 9197->9202 9200 aabaf8 ___free_lconv_mon 14 API calls 9198->9200 9199 aafaf1 HeapAlloc 9201 aafb04 9199->9201 9199->9202 9200->9201 9201->9162 9202->9198 9202->9199 9203 aaed5b _unexpected 2 API calls 9202->9203 9203->9202 9205 aadd98 43 API calls 9204->9205 9206 aae288 9205->9206 9208 aae2c5 IsValidCodePage 9206->9208 9213 aae301 __FrameHandler3::FrameUnwindToState 9206->9213 9207 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9209 aae0af 9207->9209 9210 aae2d7 9208->9210 9208->9213 9209->9169 9209->9175 9211 aae306 GetCPInfo 9210->9211 9214 aae2e0 __FrameHandler3::FrameUnwindToState 9210->9214 9211->9213 9211->9214 9213->9207 9271 aade6c 9214->9271 9216 aadc96 ___scrt_is_nonwritable_in_current_image 9215->9216 9355 aad642 EnterCriticalSection 9216->9355 9218 aadca0 9356 aadcd7 9218->9356 9223->9183 9227 aad68a LeaveCriticalSection 9224->9227 9226 aae1f3 9226->9182 9227->9226 9229 aadb47 9228->9229 9235 aadb40 9228->9235 9230 aad240 _unexpected 41 API calls 9229->9230 9229->9235 9231 aadb68 9230->9231 9236 ab046d 9231->9236 9235->9193 9235->9194 9237 ab0480 9236->9237 9238 aadb7e 9236->9238 9237->9238 9244 aaff56 9237->9244 9240 ab04cb 9238->9240 9241 ab04de 9240->9241 9242 ab04f3 9240->9242 9241->9242 9266 aae255 9241->9266 9242->9235 9245 aaff62 ___scrt_is_nonwritable_in_current_image 9244->9245 9246 aad240 _unexpected 41 API calls 9245->9246 9247 aaff6b 9246->9247 9248 aaffb1 9247->9248 9257 aad642 EnterCriticalSection 9247->9257 9248->9238 9250 aaff89 9258 aaffd7 9250->9258 9255 aacd36 __FrameHandler3::FrameUnwindToState 41 API calls 9256 aaffd6 9255->9256 9257->9250 9259 aaff9a 9258->9259 9260 aaffe5 _unexpected 9258->9260 9262 aaffb6 9259->9262 9260->9259 9261 aafd0a _unexpected 14 API calls 9260->9261 9261->9259 9265 aad68a LeaveCriticalSection 9262->9265 9264 aaffad 9264->9248 9264->9255 9265->9264 9267 aad240 _unexpected 41 API calls 9266->9267 9268 aae25a 9267->9268 9269 aae16d ___scrt_uninitialize_crt 41 API calls 9268->9269 9270 aae265 9269->9270 9270->9242 9272 aade94 GetCPInfo 9271->9272 9273 aadf5d 9271->9273 9272->9273 9275 aadeac 9272->9275 9274 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9273->9274 9277 aae016 9274->9277 9282 aafb64 9275->9282 9277->9213 9281 ab0dae 45 API calls 9281->9273 9283 aadb29 41 API calls 9282->9283 9284 aafb84 9283->9284 9302 aae50a 9284->9302 9286 aafc48 9290 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9286->9290 9287 aafc40 9305 aafc6d 9287->9305 9288 aafbb1 9288->9286 9288->9287 9289 aafbd6 __FrameHandler3::FrameUnwindToState __alloca_probe_16 9288->9289 9292 aafac8 15 API calls 9288->9292 9289->9287 9294 aae50a ___scrt_uninitialize_crt MultiByteToWideChar 9289->9294 9293 aadf14 9290->9293 9292->9289 9297 ab0dae 9293->9297 9295 aafc21 9294->9295 9295->9287 9296 aafc2c GetStringTypeW 9295->9296 9296->9287 9298 aadb29 41 API calls 9297->9298 9299 ab0dc1 9298->9299 9309 ab0bc0 9299->9309 9303 aae51b MultiByteToWideChar 9302->9303 9303->9288 9306 aafc8a 9305->9306 9307 aafc79 9305->9307 9306->9286 9307->9306 9308 aad52b ___free_lconv_mon 14 API calls 9307->9308 9308->9306 9310 ab0bdb 9309->9310 9311 aae50a ___scrt_uninitialize_crt MultiByteToWideChar 9310->9311 9314 ab0c21 9311->9314 9312 aa73ee __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 9313 aadf35 9312->9313 9313->9281 9315 aafac8 15 API calls 9314->9315 9317 ab0c47 __alloca_probe_16 9314->9317 9318 ab0d99 9314->9318 9329 ab0ccd 9314->9329 9315->9317 9316 aafc6d __freea 14 API calls 9316->9318 9319 aae50a ___scrt_uninitialize_crt MultiByteToWideChar 9317->9319 9317->9329 9318->9312 9320 ab0c8c 9319->9320 9320->9329 9337 aae9ce 9320->9337 9323 ab0cbe 9326 aae9ce 6 API calls 9323->9326 9323->9329 9324 ab0cf6 9325 ab0d81 9324->9325 9327 aafac8 15 API calls 9324->9327 9330 ab0d08 __alloca_probe_16 9324->9330 9328 aafc6d __freea 14 API calls 9325->9328 9326->9329 9327->9330 9328->9329 9329->9316 9330->9325 9331 aae9ce 6 API calls 9330->9331 9332 ab0d4b 9331->9332 9332->9325 9343 aae586 9332->9343 9334 ab0d65 9334->9325 9335 ab0d6e 9334->9335 9336 aafc6d __freea 14 API calls 9335->9336 9336->9329 9346 aae6c2 9337->9346 9341 aae9df 9341->9323 9341->9324 9341->9329 9342 aaea1f LCMapStringW 9342->9341 9344 aae59d WideCharToMultiByte 9343->9344 9344->9334 9347 aae7c1 _unexpected 5 API calls 9346->9347 9348 aae6d8 9347->9348 9348->9341 9349 aaea2b 9348->9349 9352 aae6dc 9349->9352 9351 aaea36 9351->9342 9353 aae7c1 _unexpected 5 API calls 9352->9353 9354 aae6f2 9353->9354 9354->9351 9355->9218 9366 aae470 9356->9366 9358 aadcf9 9359 aae470 41 API calls 9358->9359 9360 aadd18 9359->9360 9361 aad52b ___free_lconv_mon 14 API calls 9360->9361 9362 aadcad 9360->9362 9361->9362 9363 aadccb 9362->9363 9380 aad68a LeaveCriticalSection 9363->9380 9365 aadcb9 9365->9173 9367 aae481 9366->9367 9371 aae47d __InternalCxxFrameHandler 9366->9371 9368 aae488 9367->9368 9372 aae49b __FrameHandler3::FrameUnwindToState 9367->9372 9369 aabaf8 ___free_lconv_mon 14 API calls 9368->9369 9370 aae48d 9369->9370 9373 aaba3a ___std_exception_copy 41 API calls 9370->9373 9371->9358 9372->9371 9374 aae4c9 9372->9374 9375 aae4d2 9372->9375 9373->9371 9376 aabaf8 ___free_lconv_mon 14 API calls 9374->9376 9375->9371 9378 aabaf8 ___free_lconv_mon 14 API calls 9375->9378 9377 aae4ce 9376->9377 9379 aaba3a ___std_exception_copy 41 API calls 9377->9379 9378->9377 9379->9371 9380->9365 9401 aacbd6 9404 aacb5d 9401->9404 9405 aacb69 ___scrt_is_nonwritable_in_current_image 9404->9405 9412 aad642 EnterCriticalSection 9405->9412 9407 aacb73 9408 aacba1 9407->9408 9410 aaffd7 ___scrt_uninitialize_crt 14 API calls 9407->9410 9413 aacbbf 9408->9413 9410->9407 9412->9407 9416 aad68a LeaveCriticalSection 9413->9416 9415 aacbad 9416->9415

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00AA6C1E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00AA6C2C
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 00AA6C33
                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00AA6C72
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 00AA6C8D
                                                                                                                                                                                                      • GetCommandLineW.KERNEL32(?), ref: 00AA6C9C
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 00AA6CAF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                                                                                                                                      • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                                      • API String ID: 1042781669-3472957018
                                                                                                                                                                                                      • Opcode ID: 4534ed7f0691b37d5b80aa273610fdd533e0c85d082cdfa6d153ef61c0fe4acb
                                                                                                                                                                                                      • Instruction ID: bf502264e3f60f96ac721fa334e6713dd266951d9d26e9d7dd535939d3505737
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4534ed7f0691b37d5b80aa273610fdd533e0c85d082cdfa6d153ef61c0fe4acb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B11C232944216BBC711EBF49D4AA6E7778EF467A0B180115F902A72E1EB648D019FA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AABEC7 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,?,00AABEC1,?,00AAB83D,?,?,E68A7D01,00AAB83D,?), ref: 00AABED8
                                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000,?,00AABEC1,?,00AAB83D,?,?,E68A7D01,00AAB83D,?), ref: 00AABEDF
                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00AABEF1
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                      • Opcode ID: 8ba82d5a34684ac3e3d5cb69118d87f3d906ecd6df830ee93533c05f83efcbd3
                                                                                                                                                                                                      • Instruction ID: 2df379eef9cb9a02bd2c579e9fb69a1972a5825e1b44d27eb0b8c06d0ba6b284
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8ba82d5a34684ac3e3d5cb69118d87f3d906ecd6df830ee93533c05f83efcbd3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6D09E31014144BFCF11BFA1DD0D99D3F26BF85341B044115BA194B173DB729A539AA1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA6887 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 00AA68B9
                                                                                                                                                                                                      • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 00AA697C
                                                                                                                                                                                                        • Part of subcall function 00AA6F7D: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,00AA6912,-00000010), ref: 00AA6FAE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFindFolderModuleNamePathResource
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2248019921-0
                                                                                                                                                                                                      • Opcode ID: a0ec0d5a19dd5cc5dcb9a60a6b0221c18d6c17297282f2e77d35776fb6f3d8d0
                                                                                                                                                                                                      • Instruction ID: 52657e4ad63f2d0e4d524ea73249fb43987753fa154592a15778fed6dbc54a86
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0ec0d5a19dd5cc5dcb9a60a6b0221c18d6c17297282f2e77d35776fb6f3d8d0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D418D71D00219AFCB04EFB8CA959FEB779AF42740B584569A912A72D1EB305E05CF90
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AAD391 Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00AABAFD,00AAD5CB,?,00AABB6F,00000000,00AAC8BB,00000004,?,00000000,?,00AAC6B5,?,00000004,00000004), ref: 00AAD395
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000), ref: 00AAD437
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1452528299-0
                                                                                                                                                                                                      • Opcode ID: 24376cd3a3d0740de4ac36d6ea11bbdf10fdb21d30fc27d7cb1fb9dbdf3d4384
                                                                                                                                                                                                      • Instruction ID: a91e0ba10e3d2c125e55ce56588ec1ba4f428cc25ba8cacc83d62f72025e0100
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 24376cd3a3d0740de4ac36d6ea11bbdf10fdb21d30fc27d7cb1fb9dbdf3d4384
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 48110831A887056FDB52BBF59DDAF2B269CAF073B87540234F553874E2DB608C0652A0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AAD6D2 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 119 aad6d2-aad6dd 120 aad6eb-aad6f1 119->120 121 aad6df-aad6e9 119->121 123 aad70a-aad71b RtlAllocateHeap 120->123 124 aad6f3-aad6f4 120->124 121->120 122 aad71f-aad72a call aabaf8 121->122 128 aad72c-aad72e 122->128 125 aad71d 123->125 126 aad6f6-aad6fd call aacc5f 123->126 124->123 125->128 126->122 132 aad6ff-aad708 call aaed5b 126->132 132->122 132->123
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000008,?,?,?,00AAD3DE,00000001,00000364,?,00000006,000000FF,?,00AABB6F,00000000,00AAC8BB,00000004), ref: 00AAD713
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                      • Opcode ID: 22c3428eeee71cfb7e3f57fb061d3586789566f07b50ce2c2c94e46d99c1469f
                                                                                                                                                                                                      • Instruction ID: e8e08a0704b3575960490845f7f96dd19c0b79e421e86bc44acaf9af1f014350
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 22c3428eeee71cfb7e3f57fb061d3586789566f07b50ce2c2c94e46d99c1469f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DBF0E932510224A7DB295F769C05B5B7758AF437B0F144215F84AA79E5DB70D80142E0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00AAD9B3 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00AADA4E
                                                                                                                                                                                                      • FindNextFileW.KERNEL32(00000000,?), ref: 00AADAC9
                                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00AADAEB
                                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00AADB0E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1164774033-0
                                                                                                                                                                                                      • Opcode ID: 053b2e105d626873ab717db3523e54cd11337b7e7d964885e887f5d7b2ea3478
                                                                                                                                                                                                      • Instruction ID: cf6fed89098dbac8445d9f39e0477e278de86ba188433b8d86253fe0ab4895e7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 053b2e105d626873ab717db3523e54cd11337b7e7d964885e887f5d7b2ea3478
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E441E771A04219AEDB20EFA8DD88EBEB378EF86344F044195E487D75D4E7309E80CB64
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA7BB0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00AA7BBC
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 00AA7C88
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AA7CA8
                                                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(?), ref: 00AA7CB2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 254469556-0
                                                                                                                                                                                                      • Opcode ID: 0722880166c796fd0262ad1317caaabc6dadd8952b94f3c7d34685eafb5c593a
                                                                                                                                                                                                      • Instruction ID: 3748dc6da7c188c6ea7d28e48536c1b77c8e566e83a712d6e02f68b9bba5d229
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0722880166c796fd0262ad1317caaabc6dadd8952b94f3c7d34685eafb5c593a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59311A75D09219DBDB11EFA4DD897CDBBF8AF08300F10419AE40DA7290EB715A85CF45
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA7423 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 225 aa7423-aa7444 InitializeCriticalSectionAndSpinCount GetModuleHandleW 226 aa7446-aa7455 GetModuleHandleW 225->226 227 aa7457-aa7473 GetProcAddress * 2 225->227 226->227 228 aa749d-aa74b7 call aa7bb0 DeleteCriticalSection 226->228 229 aa7487-aa749b CreateEventW 227->229 230 aa7475-aa7477 227->230 235 aa74b9-aa74ba CloseHandle 228->235 236 aa74c0 228->236 229->228 231 aa7484-aa7486 229->231 230->229 233 aa7479-aa747f 230->233 233->231 235->236
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • InitializeCriticalSectionAndSpinCount.KERNEL32(00AB592C,00000FA0,?,?,00AA7401), ref: 00AA742F
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00AA7401), ref: 00AA743A
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00AA7401), ref: 00AA744B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00AA745D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00AA746B
                                                                                                                                                                                                      • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00AA7401), ref: 00AA748E
                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(00AB592C,00000007,?,?,00AA7401), ref: 00AA74AA
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,00AA7401), ref: 00AA74BA
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00AA7435
                                                                                                                                                                                                      • SleepConditionVariableCS, xrefs: 00AA7457
                                                                                                                                                                                                      • kernel32.dll, xrefs: 00AA7446
                                                                                                                                                                                                      • WakeAllConditionVariable, xrefs: 00AA7463
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                                      • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                                      • API String ID: 2565136772-3242537097
                                                                                                                                                                                                      • Opcode ID: bfa625bad20ee729c72c2a855e8265c12ef458d4d5dbf51bbc331b743cd4d223
                                                                                                                                                                                                      • Instruction ID: 54e1442ea24c1ab5328306794dccf2644cdf25fec87ac38e524c09b23e17058b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bfa625bad20ee729c72c2a855e8265c12ef458d4d5dbf51bbc331b743cd4d223
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59017571A49711BBD721ABF56C09B6F3B68AB86761B040616F904D31F2DBA0C8468660
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AAA670 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 237 aaa670-aaa69b call aab229 240 aaa6a1-aaa6a4 237->240 241 aaaa14-aaaa19 call aacd36 237->241 240->241 242 aaa6aa-aaa6b3 240->242 244 aaa6b9-aaa6bd 242->244 245 aaa7b0-aaa7b6 242->245 244->245 247 aaa6c3-aaa6ca 244->247 248 aaa7be-aaa7cc 245->248 249 aaa6cc-aaa6d3 247->249 250 aaa6e2-aaa6e7 247->250 251 aaa97d-aaa980 248->251 252 aaa7d2-aaa7d6 248->252 249->250 253 aaa6d5-aaa6dc 249->253 250->245 256 aaa6ed-aaa6f5 call aa9b24 250->256 254 aaa982-aaa985 251->254 255 aaa9a3-aaa9ac call aa9b24 251->255 252->251 257 aaa7dc-aaa7e3 252->257 253->245 253->250 254->241 258 aaa98b-aaa9a0 call aaaa1a 254->258 255->241 273 aaa9ae-aaa9b2 255->273 272 aaa6fb-aaa714 call aa9b24 * 2 256->272 256->273 260 aaa7fb-aaa801 257->260 261 aaa7e5-aaa7ec 257->261 258->255 267 aaa919-aaa91d 260->267 268 aaa807-aaa82e call aaa063 260->268 261->260 265 aaa7ee-aaa7f5 261->265 265->251 265->260 269 aaa929-aaa935 267->269 270 aaa91f-aaa928 call aa990e 267->270 268->267 279 aaa834-aaa837 268->279 269->255 277 aaa937-aaa93b 269->277 270->269 272->241 294 aaa71a-aaa720 272->294 281 aaa94d-aaa955 277->281 282 aaa93d-aaa945 277->282 284 aaa83a-aaa84f 279->284 286 aaa96c-aaa979 call aab0e9 281->286 287 aaa957-aaa96a call aa9b24 * 2 281->287 282->255 285 aaa947-aaa94b 282->285 289 aaa8fa-aaa90d 284->289 290 aaa855-aaa858 284->290 285->255 285->281 303 aaa97b 286->303 304 aaa9d8-aaa9ed call aa9b24 * 2 286->304 310 aaa9b3 call aacc9b 287->310 289->284 295 aaa913-aaa916 289->295 290->289 296 aaa85e-aaa866 290->296 300 aaa74c-aaa754 call aa9b24 294->300 301 aaa722-aaa726 294->301 295->267 296->289 302 aaa86c-aaa880 296->302 320 aaa7b8-aaa7bb 300->320 321 aaa756-aaa776 call aa9b24 * 2 call aab0e9 300->321 301->300 306 aaa728-aaa72f 301->306 307 aaa883-aaa893 302->307 303->255 333 aaa9ef 304->333 334 aaa9f2-aaaa0f call aaa256 call aaafe9 call aab1a6 call aaaf60 304->334 311 aaa743-aaa746 306->311 312 aaa731-aaa738 306->312 313 aaa8bb-aaa8c8 307->313 314 aaa895-aaa8a8 call aaab50 307->314 324 aaa9b8-aaa9d3 call aa990e call aaacfb call aab2d6 310->324 311->241 311->300 312->311 318 aaa73a-aaa741 312->318 313->307 323 aaa8ca 313->323 330 aaa8aa-aaa8b0 314->330 331 aaa8cc-aaa8f4 call aaa5f0 314->331 318->300 318->311 320->248 321->320 350 aaa778-aaa77d 321->350 328 aaa8f7 323->328 324->304 328->289 330->314 336 aaa8b2-aaa8b8 330->336 331->328 333->334 334->241 336->313 350->310 352 aaa783-aaa796 call aaad50 350->352 352->324 357 aaa79c-aaa7a8 352->357 357->310 358 aaa7ae 357->358 358->352
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 00AAA76D
                                                                                                                                                                                                      • type_info::operator==.LIBVCRUNTIME ref: 00AAA78F
                                                                                                                                                                                                      • ___TypeMatch.LIBVCRUNTIME ref: 00AAA89E
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 00AAA970
                                                                                                                                                                                                      • _UnwindNestedFrames.LIBCMT ref: 00AAA9F4
                                                                                                                                                                                                      • CallUnexpected.LIBVCRUNTIME ref: 00AAAA0F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 2123188842-393685449
                                                                                                                                                                                                      • Opcode ID: 44c4c93df66c266eaf07625a4e632ca842393df22b79f0696a501cb2330a42eb
                                                                                                                                                                                                      • Instruction ID: 61cfc544f85a2e341fe3bb9b730f5b3fcbae5a301e0d06db943e3522c8a06d13
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 44c4c93df66c266eaf07625a4e632ca842393df22b79f0696a501cb2330a42eb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ECB18B71800209EFCF25DFA8D9819AFB7F5FF2A310F15415AE8056B292D335DA51CBA2
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA6A8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00AA6AE1
                                                                                                                                                                                                      • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 00AA6AFC
                                                                                                                                                                                                      • PathAppendW.SHLWAPI(?,goopdate.dll,?,?,00000104), ref: 00AA6B2B
                                                                                                                                                                                                        • Part of subcall function 00AA6820: GetLastError.KERNEL32(00AA6AF0,?,?,00000104), ref: 00AA6820
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                                                                                                                                      • String ID: goopdate.dll
                                                                                                                                                                                                      • API String ID: 3739599460-235033069
                                                                                                                                                                                                      • Opcode ID: e03b8de00f282905a825bf9c97bb26d34c24d1b7b8bee3a22cce54e10164b5ba
                                                                                                                                                                                                      • Instruction ID: 634af0dd957d821aff33e41da0981cd966e3353556b6c638945e4c3cc26b8898
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e03b8de00f282905a825bf9c97bb26d34c24d1b7b8bee3a22cce54e10164b5ba
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B14164F590121DAACF20EB64DD45EDE73BC9F46340F1486E5A505E31C2EB349E898E74
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA97B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 405 aa97b0-aa9801 call ab4430 call aa9770 call aa9de7 412 aa985d-aa9860 405->412 413 aa9803-aa9815 405->413 414 aa9862-aa986f call aa9dd0 412->414 415 aa9880-aa9889 412->415 413->415 416 aa9817-aa982e 413->416 422 aa9874-aa987d call aa9770 414->422 418 aa9830-aa983e call aa9d70 416->418 419 aa9844 416->419 426 aa9840 418->426 427 aa9854-aa985b 418->427 421 aa9847-aa984c 419->421 421->416 424 aa984e-aa9850 421->424 422->415 424->415 428 aa9852 424->428 430 aa988a-aa9893 426->430 431 aa9842 426->431 427->422 428->422 432 aa98cd-aa98dd call aa9db0 430->432 433 aa9895-aa989c 430->433 431->421 439 aa98df-aa98ee call aa9dd0 432->439 440 aa98f1-aa990d call aa9770 call aa9d90 432->440 433->432 434 aa989e-aa98ad call ab4230 433->434 442 aa98ca 434->442 443 aa98af-aa98c7 434->443 439->440 442->432 443->442
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00AA97E7
                                                                                                                                                                                                      • ___except_validate_context_record.LIBVCRUNTIME ref: 00AA97EF
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00AA9878
                                                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 00AA98A3
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00AA98F8
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 1170836740-1018135373
                                                                                                                                                                                                      • Opcode ID: 7f968a32a12a25470e4cf800a0bf01b21eaf8b68b9c38416047c9722c1be345b
                                                                                                                                                                                                      • Instruction ID: 4ae98942cc2192b779a73acaae5def3527aa97398111eb496af40732b3d749fe
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7f968a32a12a25470e4cf800a0bf01b21eaf8b68b9c38416047c9722c1be345b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C0418034E00209ABCF10EF68C884AAFBBF5BF4B314F148159E8159B3D2D7359A55CBA1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AAE6F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 451 aae6f6-aae702 452 aae794-aae797 451->452 453 aae79d 452->453 454 aae707-aae718 452->454 455 aae79f-aae7a3 453->455 456 aae71a-aae71d 454->456 457 aae725-aae73e LoadLibraryExW 454->457 458 aae7bd-aae7bf 456->458 459 aae723 456->459 460 aae740-aae749 GetLastError 457->460 461 aae7a4-aae7b4 457->461 458->455 463 aae791 459->463 464 aae74b-aae75d call aacec8 460->464 465 aae782-aae78f 460->465 461->458 462 aae7b6-aae7b7 FreeLibrary 461->462 462->458 463->452 464->465 468 aae75f-aae771 call aacec8 464->468 465->463 468->465 471 aae773-aae780 LoadLibraryExW 468->471 471->461 471->465
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,00AAE803,00AAC8BB,0000000C,?,00000000,00000000,?,00AAE95D,00000021,FlsSetValue,00AA2924,00AA292C,?), ref: 00AAE7B7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-537541572
                                                                                                                                                                                                      • Opcode ID: de6c4ad3dedeafc126ff7aa1e6b08dc207bfabfdfb29540222aa32e116247729
                                                                                                                                                                                                      • Instruction ID: 785cd66535bef6d66dbb902e13f0f4545fa68c1ddfba70b0c27c7a9c49a199a6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: de6c4ad3dedeafc126ff7aa1e6b08dc207bfabfdfb29540222aa32e116247729
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B21DA32A01251ABCB21DBA8EC84E5A3768EF53770F250321ED15A72E1E774ED01C6D0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA9B32 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,00AA9B29,00AA9ABA,00AA7D97), ref: 00AA9B40
                                                                                                                                                                                                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AA9B4E
                                                                                                                                                                                                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AA9B67
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,00AA9B29,00AA9ABA,00AA7D97), ref: 00AA9BB9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3852720340-0
                                                                                                                                                                                                      • Opcode ID: 21e6083757fae4187674c26512de148c336a341761789c03f42e3d0a341d9e02
                                                                                                                                                                                                      • Instruction ID: cab30386f2186267b8aca2c31ea4b4a78bf180a51542bdb57b88ed20d3636917
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 21e6083757fae4187674c26512de148c336a341761789c03f42e3d0a341d9e02
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C801F73261E7115EEB2577B4BC95B6B3664EB57BB5720032AF510870F2EF524C0291A0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA9E17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,?,00AA9ED8,?,?,00AB5CEC,00000000,?,00AAA003,00000004,InitializeCriticalSectionEx,00AA1C14,InitializeCriticalSectionEx,00000000), ref: 00AA9EA7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-2084034818
                                                                                                                                                                                                      • Opcode ID: 717fd8528d3dbad96fed4eab199a67ae3c694ae81a6943cb1f08b2678f865797
                                                                                                                                                                                                      • Instruction ID: edad2745c2c02498bfeb3ef84bc1256e041462211bbca7c4f98e63c0cf65c26a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 717fd8528d3dbad96fed4eab199a67ae3c694ae81a6943cb1f08b2678f865797
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D11C232A45725ABDF32DBA89C41B6F73A4AF47770F150621E901EB2D2E770ED018AD1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AABF1A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E68A7D01,?,?,00000000,00AB44E2,000000FF,?,00AABEED,?,?,00AABEC1,?), ref: 00AABF4F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AABF61
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,00000000,00AB44E2,000000FF,?,00AABEED,?,?,00AABEC1,?), ref: 00AABF83
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                      • Opcode ID: bac02fb136868bc024f7f50da957b796718d718e0621413e0dfe3f5474651a94
                                                                                                                                                                                                      • Instruction ID: 5d97dc3024d112242384226fe6b7cf9f28de5edd7b8272ec7c00258d168e042f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bac02fb136868bc024f7f50da957b796718d718e0621413e0dfe3f5474651a94
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3901A731914616FFDB11DF90DC05BBEB7B8FB45711F044626F811A32E1D7B59800CAA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AB0BC0 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 00AB0C47
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 00AB0D08
                                                                                                                                                                                                      • __freea.LIBCMT ref: 00AB0D6F
                                                                                                                                                                                                        • Part of subcall function 00AAFAC8: HeapAlloc.KERNEL32(00000000,00000000,00AAC8BB,?,00AAD5AD,?,00000000,?,00AABB6F,00000000,00AAC8BB,00000004,?,00000000,?,00AAC6B5), ref: 00AAFAFA
                                                                                                                                                                                                      • __freea.LIBCMT ref: 00AB0D84
                                                                                                                                                                                                      • __freea.LIBCMT ref: 00AB0D94
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1096550386-0
                                                                                                                                                                                                      • Opcode ID: a56bdd232d0436d822b9b87868fa67ffbb07a3a22bec33238bdfa593beea4f04
                                                                                                                                                                                                      • Instruction ID: 278f54f56d29b43b7393674630cf3ff9ee4ef3f97aac345faea7a8e5dcc0c404
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a56bdd232d0436d822b9b87868fa67ffbb07a3a22bec33238bdfa593beea4f04
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CC519E7260020AAFEB259FA4CD81EFB7BADEF45750B150629FD08D7192EB70DC1097A0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AB0FA1 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetConsoleOutputCP.KERNEL32(E68A7D01,?,00000000,?), ref: 00AB1004
                                                                                                                                                                                                        • Part of subcall function 00AAE586: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AB0D65,?,00000000,-00000008), ref: 00AAE632
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00AB125F
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00AB12A7
                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00AB134A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2112829910-0
                                                                                                                                                                                                      • Opcode ID: 0c76d4d4ed30c96427c607dda15d80339ed1d018be7be25a817a62955a214984
                                                                                                                                                                                                      • Instruction ID: 445c92580a274fe0b8719e8d9e884fe3cf930f1a3483c200eda1017b1c6043b1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c76d4d4ed30c96427c607dda15d80339ed1d018be7be25a817a62955a214984
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9CD15A75D042589FCB15CFE8D890AEDBBF8FF09314F58462AE855EB252E730A942CB50
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AAA419 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AdjustPointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1740715915-0
                                                                                                                                                                                                      • Opcode ID: 0243c41e70ee3b680898058a1cf0e5ce663b507c8605006b53a30b6d9b8c165a
                                                                                                                                                                                                      • Instruction ID: 240e2381f2d755e28d12718a462a7e506323765e361886d6e6d46beaa02ad23a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0243c41e70ee3b680898058a1cf0e5ce663b507c8605006b53a30b6d9b8c165a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C51CC72E00603AFDB2A9F54D941BBA77E4BF6A310F14452DE806872D1E772EC41CB96
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AB27B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00AB1F6A,?,00000001,?,?,?,00AB139E,?,?,00000000), ref: 00AB27CD
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00AB1F6A,?,00000001,?,?,?,00AB139E,?,?,00000000,?,?,?,00AB1925,?), ref: 00AB27D9
                                                                                                                                                                                                        • Part of subcall function 00AB279F: CloseHandle.KERNEL32(FFFFFFFE,00AB27E9,?,00AB1F6A,?,00000001,?,?,?,00AB139E,?,?,00000000,?,?), ref: 00AB27AF
                                                                                                                                                                                                      • ___initconout.LIBCMT ref: 00AB27E9
                                                                                                                                                                                                        • Part of subcall function 00AB2761: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00AB2790,00AB1F57,?,?,00AB139E,?,?,00000000,?), ref: 00AB2774
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00AB1F6A,?,00000001,?,?,?,00AB139E,?,?,00000000,?), ref: 00AB27FE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2744216297-0
                                                                                                                                                                                                      • Opcode ID: db553f154cc59bc9f9a95f0f9236b7f1718c364d62dde02089b516195ddbcfcb
                                                                                                                                                                                                      • Instruction ID: b5543d6a2cbdf526f1423525dbc03415da66654828d91db95171469d3b64ce94
                                                                                                                                                                                                      • Opcode Fuzzy Hash: db553f154cc59bc9f9a95f0f9236b7f1718c364d62dde02089b516195ddbcfcb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FDF0AC36501124BBCF226FE5ED08ADE3F6AFB483A1F054251FE1995132CA728861EB91
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA7593 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SleepConditionVariableCS.KERNELBASE(?,00AA7530,00000064), ref: 00AA75B6
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00AB592C,?,?,00AA7530,00000064,?,00AA6688,00AB64A0,?,?,00AA6DDF,?,00AA6898), ref: 00AA75C0
                                                                                                                                                                                                      • WaitForSingleObjectEx.KERNEL32(?,00000000,?,00AA7530,00000064,?,00AA6688,00AB64A0,?,?,00AA6DDF,?,00AA6898), ref: 00AA75D1
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00AB592C,?,00AA7530,00000064,?,00AA6688,00AB64A0,?,?,00AA6DDF,?,00AA6898), ref: 00AA75D8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3269011525-0
                                                                                                                                                                                                      • Opcode ID: 8d72c399af0898cdd0f8fc677b3157109a2ae1fea43d24ac914d144030ab1aef
                                                                                                                                                                                                      • Instruction ID: 9fe2dc3cb8c41b302365d5d28ea9675d368ad44e1e6caed595afef842f70057c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8d72c399af0898cdd0f8fc677b3157109a2ae1fea43d24ac914d144030ab1aef
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 04E0ED32D45A25FBCB11BBA4AC08BAE7F29EB49771B040111F909561B3C7A259128BD0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AAAA1A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00AAAA3F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EncodePointer
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 2118026453-2084237596
                                                                                                                                                                                                      • Opcode ID: 17efb576c0e86373780d11fe965be5402a51537c5fa2ac18fa9105b66c86070c
                                                                                                                                                                                                      • Instruction ID: 74a2e934ec15173d35fbf61d51edf1f8a845f245abc2914c027e98925907a4fa
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 17efb576c0e86373780d11fe965be5402a51537c5fa2ac18fa9105b66c86070c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F3413572900209AFCF16DF98C981AAEBBF6FF59304F188159F904A72A1D3359D50DB62
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA69EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(?,Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019},00000000,00020019,?,?,?), ref: 00AA6A15
                                                                                                                                                                                                      • SHQueryValueExW.SHLWAPI(?,00AA5D10,00000000,?,00000000,?,00000032,?,?), ref: 00AA6A58
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}, xrefs: 00AA6A07
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: OpenQueryValue
                                                                                                                                                                                                      • String ID: Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
                                                                                                                                                                                                      • API String ID: 4153817207-790910960
                                                                                                                                                                                                      • Opcode ID: d375e3d0b68ebcbb573b993da14173a2216daa9918e9200b73ebd2cdb0b34a14
                                                                                                                                                                                                      • Instruction ID: b733b47be3837a304efc6322696d60503aaa9f73d49ea96b337c0cd86fa93e7f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d375e3d0b68ebcbb573b993da14173a2216daa9918e9200b73ebd2cdb0b34a14
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D21173B2D40229AB8B20DBA98D05ABEBAB8EB42750F144265B811F71D1D7748A008BA0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00AA72D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00AA6511: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00AA6516
                                                                                                                                                                                                        • Part of subcall function 00AA6511: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00AA6520
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32(?,?,?,00AA648A), ref: 00AA7309
                                                                                                                                                                                                      • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AA648A), ref: 00AA7318
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00AA7313
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000001.00000002.2345494086.0000000000AA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00AA0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000001.00000002.2343119734.0000000000AA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345533299.0000000000AB5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000001.00000002.2345596039.0000000000AB7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_aa0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                                      • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                      • API String ID: 450123788-631824599
                                                                                                                                                                                                      • Opcode ID: 6a74e5ded3aeb5c24eddf866c7447a72c27e669790e7573d1b214419074286da
                                                                                                                                                                                                      • Instruction ID: 4e4aa8d01fe8beba780799f1dfa1bb7de414aa8fd7f0e6af3d40c8cd62c0fbbb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6a74e5ded3aeb5c24eddf866c7447a72c27e669790e7573d1b214419074286da
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AFE06D706047418BC760EF68EA0434A7AE4AF02745F004A6DE896C76D2DBB4D8448BA1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:3.7%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                                      Total number of Limit Nodes:24
                                                                                                                                                                                                      execution_graph 9417 9b2a1a IsProcessorFeaturePresent 9418 9a6618 HeapSize 8479 9af39e 8480 9af3ab 8479->8480 8481 9ad6d2 _unexpected 14 API calls 8480->8481 8482 9af3c5 8481->8482 8483 9ad52b __freea 14 API calls 8482->8483 8484 9af3d1 8483->8484 8485 9ad6d2 _unexpected 14 API calls 8484->8485 8488 9af3f7 8484->8488 8487 9af3eb 8485->8487 8489 9ad52b __freea 14 API calls 8487->8489 8490 9af403 8488->8490 8491 9ae983 8488->8491 8489->8488 8492 9ae7c1 _unexpected 5 API calls 8491->8492 8493 9ae99f 8492->8493 8494 9ae9bd InitializeCriticalSectionAndSpinCount 8493->8494 8495 9ae9a8 8493->8495 8494->8495 8495->8488 9422 9ac01c 9423 9ac033 9422->9423 9430 9ac02c 9422->9430 9424 9ac054 GetModuleFileNameW 9423->9424 9425 9ac03e 9423->9425 9428 9ac079 9424->9428 9426 9abaf8 ___std_exception_copy 14 API calls 9425->9426 9427 9ac043 9426->9427 9429 9aba3a ___std_exception_copy 41 API calls 9427->9429 9445 9ac2f3 9428->9445 9429->9430 9433 9ac0bb 9436 9ac0b4 9433->9436 9437 9ac0f5 9433->9437 9434 9ac0af 9435 9abaf8 ___std_exception_copy 14 API calls 9434->9435 9435->9436 9438 9ad52b __freea 14 API calls 9436->9438 9439 9ac10c 9437->9439 9440 9ac116 9437->9440 9438->9430 9441 9ad52b __freea 14 API calls 9439->9441 9443 9ad52b __freea 14 API calls 9440->9443 9442 9ac114 9441->9442 9444 9ad52b __freea 14 API calls 9442->9444 9443->9442 9444->9430 9446 9ac0a6 9445->9446 9447 9ac304 9445->9447 9446->9433 9446->9434 9447->9446 9448 9ad6d2 _unexpected 14 API calls 9447->9448 9449 9ac32d 9448->9449 9450 9ad52b __freea 14 API calls 9449->9450 9450->9446 8496 9a6491 8497 9a64a0 RaiseException 8496->8497 9451 9a9b08 9452 9a9b12 9451->9452 9453 9a9b1f 9451->9453 9452->9453 9454 9abb0b ___std_exception_destroy 14 API calls 9452->9454 9454->9453 8498 9ab08d 8504 9ab02f __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 8498->8504 8499 9ab0a8 8501 9acd36 CallUnexpected 41 API calls 8499->8501 8503 9ab0ad __FrameHandler3::FrameUnwindToState 8499->8503 8502 9ab0e8 8501->8502 8504->8499 8505 9ab0cf 8504->8505 8510 9a9b24 8505->8510 8507 9ab0d4 8508 9ab0df 8507->8508 8509 9a9b24 CallUnexpected 51 API calls 8507->8509 8508->8499 8509->8508 8523 9a9b32 8510->8523 8512 9a9b29 8512->8507 8537 9aeeb2 8512->8537 8515 9acd46 8517 9acd6f 8515->8517 8518 9acd50 IsProcessorFeaturePresent 8515->8518 8520 9abfc9 CallUnexpected 23 API calls 8517->8520 8519 9acd5c 8518->8519 8521 9ab83e CallUnexpected 8 API calls 8519->8521 8522 9acd79 8520->8522 8521->8517 8524 9a9b3b 8523->8524 8525 9a9b3e GetLastError 8523->8525 8524->8512 8567 9a9f70 8525->8567 8528 9a9b72 8529 9a9bb8 SetLastError 8528->8529 8529->8512 8530 9a9fab ___vcrt_FlsSetValue 6 API calls 8531 9a9b6c CallUnexpected 8530->8531 8531->8528 8532 9a9b94 8531->8532 8533 9a9fab ___vcrt_FlsSetValue 6 API calls 8531->8533 8534 9a9fab ___vcrt_FlsSetValue 6 API calls 8532->8534 8535 9a9ba8 8532->8535 8533->8532 8534->8535 8572 9abb0b 8535->8572 8575 9aede4 8537->8575 8540 9aeef7 8541 9aef03 CallCatchBlock 8540->8541 8542 9ad391 ___std_exception_copy 14 API calls 8541->8542 8545 9aef30 CallUnexpected 8541->8545 8548 9aef2a CallUnexpected 8541->8548 8542->8548 8543 9aef77 8544 9abaf8 ___std_exception_copy 14 API calls 8543->8544 8546 9aef7c 8544->8546 8547 9aefa3 8545->8547 8586 9ad642 EnterCriticalSection 8545->8586 8549 9aba3a ___std_exception_copy 41 API calls 8546->8549 8552 9af0d6 8547->8552 8553 9aefe5 8547->8553 8563 9af014 8547->8563 8548->8543 8548->8545 8566 9aef61 8548->8566 8549->8566 8554 9af0e1 8552->8554 8591 9ad68a LeaveCriticalSection 8552->8591 8559 9ad240 _unexpected 41 API calls 8553->8559 8553->8563 8557 9abfc9 CallUnexpected 23 API calls 8554->8557 8558 9af0e9 8557->8558 8561 9af009 8559->8561 8560 9ad240 _unexpected 41 API calls 8564 9af069 8560->8564 8562 9ad240 _unexpected 41 API calls 8561->8562 8562->8563 8587 9af083 8563->8587 8565 9ad240 _unexpected 41 API calls 8564->8565 8564->8566 8565->8566 8566->8515 8568 9a9eb1 ___vcrt_FlsGetValue 5 API calls 8567->8568 8569 9a9f8a 8568->8569 8570 9a9fa2 TlsGetValue 8569->8570 8571 9a9b53 8569->8571 8570->8571 8571->8528 8571->8529 8571->8530 8573 9ad52b __freea 14 API calls 8572->8573 8574 9abb23 8573->8574 8574->8528 8576 9aedf0 CallCatchBlock 8575->8576 8581 9ad642 EnterCriticalSection 8576->8581 8578 9aedfe 8582 9aee3c 8578->8582 8581->8578 8585 9ad68a LeaveCriticalSection 8582->8585 8584 9acd3b 8584->8515 8584->8540 8585->8584 8586->8547 8588 9af089 8587->8588 8589 9af05a 8587->8589 8592 9ad68a LeaveCriticalSection 8588->8592 8589->8560 8589->8564 8589->8566 8591->8554 8592->8589 8593 9ab083 8596 9a9a5f 8593->8596 8597 9a9a83 8596->8597 8598 9a9a71 8596->8598 8600 9a9b24 CallUnexpected 51 API calls 8597->8600 8598->8597 8599 9a9a79 8598->8599 8602 9a9b24 CallUnexpected 51 API calls 8599->8602 8605 9a9a81 8599->8605 8601 9a9a88 8600->8601 8603 9a9b24 CallUnexpected 51 API calls 8601->8603 8601->8605 8604 9a9aa1 8602->8604 8603->8605 8606 9a9b24 CallUnexpected 51 API calls 8604->8606 8607 9a9aac 8606->8607 8610 9acc9b 8607->8610 8611 9acca7 CallCatchBlock 8610->8611 8612 9ad240 _unexpected 41 API calls 8611->8612 8615 9accac 8612->8615 8613 9acd36 CallUnexpected 41 API calls 8614 9accd6 8613->8614 8615->8613 8616 9a7a81 8619 9a8032 8616->8619 8618 9a7a86 8618->8618 8620 9a8048 8619->8620 8622 9a8051 8620->8622 8623 9a7fe5 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 8620->8623 8622->8618 8623->8622 9458 9ad601 9459 9ad60c 9458->9459 9460 9ae983 6 API calls 9459->9460 9461 9ad635 9459->9461 9462 9ad631 9459->9462 9460->9459 9464 9ad659 9461->9464 9465 9ad685 9464->9465 9466 9ad666 9464->9466 9465->9462 9467 9ad670 DeleteCriticalSection 9466->9467 9467->9465 9467->9467 9468 9b3507 9469 9b3520 __startOneArgErrorHandling 9468->9469 9470 9b3549 __startOneArgErrorHandling 9469->9470 9471 9b38a1 20 API calls 9469->9471 9471->9470 8624 9aec87 8625 9aec8c 8624->8625 8627 9aecaf 8625->8627 8628 9af62e 8625->8628 8629 9af63b 8628->8629 8633 9af65d 8628->8633 8630 9af649 DeleteCriticalSection 8629->8630 8631 9af657 8629->8631 8630->8630 8630->8631 8632 9ad52b __freea 14 API calls 8631->8632 8632->8633 8633->8625 9472 9ad107 9473 9ad112 9472->9473 9474 9ad122 9472->9474 9478 9ad128 9473->9478 9477 9ad52b __freea 14 API calls 9477->9474 9479 9ad13d 9478->9479 9480 9ad143 9478->9480 9482 9ad52b __freea 14 API calls 9479->9482 9481 9ad52b __freea 14 API calls 9480->9481 9483 9ad14f 9481->9483 9482->9480 9484 9ad52b __freea 14 API calls 9483->9484 9485 9ad15a 9484->9485 9486 9ad52b __freea 14 API calls 9485->9486 9487 9ad165 9486->9487 9488 9ad52b __freea 14 API calls 9487->9488 9489 9ad170 9488->9489 9490 9ad52b __freea 14 API calls 9489->9490 9491 9ad17b 9490->9491 9492 9ad52b __freea 14 API calls 9491->9492 9493 9ad186 9492->9493 9494 9ad52b __freea 14 API calls 9493->9494 9495 9ad191 9494->9495 9496 9ad52b __freea 14 API calls 9495->9496 9497 9ad19c 9496->9497 9498 9ad52b __freea 14 API calls 9497->9498 9499 9ad1aa 9498->9499 9504 9acf54 9499->9504 9505 9acf60 CallCatchBlock 9504->9505 9520 9ad642 EnterCriticalSection 9505->9520 9507 9acf94 9521 9acfb3 9507->9521 9510 9acf6a 9510->9507 9511 9ad52b __freea 14 API calls 9510->9511 9511->9507 9512 9acfbf 9513 9acfcb CallCatchBlock 9512->9513 9525 9ad642 EnterCriticalSection 9513->9525 9515 9acfd5 9516 9ad1f5 _unexpected 14 API calls 9515->9516 9517 9acfe8 9516->9517 9526 9ad008 9517->9526 9520->9510 9524 9ad68a LeaveCriticalSection 9521->9524 9523 9acfa1 9523->9512 9524->9523 9525->9515 9529 9ad68a LeaveCriticalSection 9526->9529 9528 9acff6 9528->9477 9529->9528 9530 9b3205 9531 9b322d 9530->9531 9532 9b325e 9531->9532 9533 9b3257 9531->9533 9534 9b3265 9531->9534 9539 9b32c0 9532->9539 9535 9b32d7 20 API calls 9533->9535 9537 9b325c 9535->9537 9540 9b32e0 9539->9540 9541 9b374f __startOneArgErrorHandling 20 API calls 9540->9541 9542 9b3263 9541->9542 7617 9a7905 7618 9a7911 CallCatchBlock 7617->7618 7643 9a7657 7618->7643 7620 9a7918 7621 9a7a6b 7620->7621 7629 9a7942 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock CallUnexpected 7620->7629 7689 9a7bb0 IsProcessorFeaturePresent 7621->7689 7623 9a7a72 7671 9ac006 7623->7671 7626 9abfc9 CallUnexpected 23 API calls 7627 9a7a80 7626->7627 7628 9a7961 7629->7628 7630 9a79e2 7629->7630 7674 9abfe0 7629->7674 7651 9a7ccb 7630->7651 7632 9a79e8 7655 9a6c1e GetModuleHandleW GetProcAddress 7632->7655 7635 9a79fd 7636 9a7d04 CallUnexpected GetModuleHandleW 7635->7636 7637 9a7a04 7636->7637 7637->7623 7638 9a7a08 7637->7638 7639 9a7a11 7638->7639 7680 9abfba 7638->7680 7683 9a77c8 7639->7683 7644 9a7660 7643->7644 7693 9a7db1 IsProcessorFeaturePresent 7644->7693 7648 9a7671 7649 9a7675 7648->7649 7703 9a9759 7648->7703 7649->7620 7765 9a95e0 7651->7765 7654 9a7cf1 7654->7632 7656 9a6c3d 7655->7656 7767 9a6887 7656->7767 7658 9a6c4c 7794 9a6dd7 7658->7794 7660 9a6c56 7797 9a6a8c 7660->7797 7663 9a6c6b LoadLibraryExW 7664 9a6c7e 7663->7664 7665 9a6c87 GetProcAddress 7663->7665 7828 9a6820 GetLastError 7664->7828 7668 9a6c99 GetCommandLineW 7665->7668 7670 9a6ca5 FreeLibrary 7665->7670 7666 9a6c83 7666->7635 7668->7670 7670->7666 7672 9abe30 CallUnexpected 23 API calls 7671->7672 7673 9a7a78 7672->7673 7673->7626 7675 9abff6 _unexpected CallCatchBlock 7674->7675 7675->7630 8126 9ad240 GetLastError 7675->8126 7677 9acd36 CallUnexpected 41 API calls 7678 9accd6 7677->7678 7681 9abe30 CallUnexpected 23 API calls 7680->7681 7682 9abfc5 7681->7682 7682->7639 7684 9a77d4 7683->7684 7685 9a77ea 7684->7685 8331 9ac9ca 7684->8331 7685->7628 7687 9a77e2 7688 9a9759 ___scrt_uninitialize_crt 7 API calls 7687->7688 7688->7685 7690 9a7bc6 CallUnexpected 7689->7690 7691 9a7c71 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7690->7691 7692 9a7cbc CallUnexpected 7691->7692 7692->7623 7694 9a766c 7693->7694 7695 9a973a 7694->7695 7709 9a9c12 7695->7709 7699 9a974b 7700 9a9756 7699->7700 7723 9a9c4e 7699->7723 7700->7648 7702 9a9743 7702->7648 7704 9a976c 7703->7704 7705 9a9762 7703->7705 7704->7649 7706 9a9bf7 ___vcrt_uninitialize_ptd 6 API calls 7705->7706 7707 9a9767 7706->7707 7708 9a9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7707->7708 7708->7704 7710 9a9c1b 7709->7710 7712 9a9c44 7710->7712 7713 9a973f 7710->7713 7727 9a9fe9 7710->7727 7714 9a9c4e ___vcrt_uninitialize_locks DeleteCriticalSection 7712->7714 7713->7702 7715 9a9bc4 7713->7715 7714->7713 7746 9a9efa 7715->7746 7720 9a9bf4 7720->7699 7722 9a9bd9 7722->7699 7724 9a9c78 7723->7724 7725 9a9c59 7723->7725 7724->7702 7726 9a9c63 DeleteCriticalSection 7725->7726 7726->7724 7726->7726 7732 9a9eb1 7727->7732 7730 9aa021 InitializeCriticalSectionAndSpinCount 7731 9aa00c 7730->7731 7731->7710 7733 9a9ec9 7732->7733 7734 9a9eec 7732->7734 7733->7734 7738 9a9e17 7733->7738 7734->7730 7734->7731 7737 9a9ede GetProcAddress 7737->7734 7743 9a9e23 ___vcrt_FlsGetValue 7738->7743 7739 9a9e97 7739->7734 7739->7737 7740 9a9e39 LoadLibraryExW 7741 9a9e9e 7740->7741 7742 9a9e57 GetLastError 7740->7742 7741->7739 7744 9a9ea6 FreeLibrary 7741->7744 7742->7743 7743->7739 7743->7740 7745 9a9e79 LoadLibraryExW 7743->7745 7744->7739 7745->7741 7745->7743 7747 9a9eb1 ___vcrt_FlsGetValue 5 API calls 7746->7747 7748 9a9f14 7747->7748 7749 9a9f2d TlsAlloc 7748->7749 7750 9a9bce 7748->7750 7750->7722 7751 9a9fab 7750->7751 7752 9a9eb1 ___vcrt_FlsGetValue 5 API calls 7751->7752 7753 9a9fc5 7752->7753 7754 9a9fe0 TlsSetValue 7753->7754 7755 9a9be7 7753->7755 7754->7755 7755->7720 7756 9a9bf7 7755->7756 7757 9a9c07 7756->7757 7758 9a9c01 7756->7758 7757->7722 7760 9a9f35 7758->7760 7761 9a9eb1 ___vcrt_FlsGetValue 5 API calls 7760->7761 7762 9a9f4f 7761->7762 7763 9a9f67 TlsFree 7762->7763 7764 9a9f5b 7762->7764 7763->7764 7764->7757 7766 9a7cde GetStartupInfoW 7765->7766 7766->7654 7768 9a6dd7 56 API calls 7767->7768 7769 9a6898 7768->7769 7770 9a68b1 GetModuleFileNameW 7769->7770 7771 9a68c9 7770->7771 7793 9a69a0 7771->7793 7830 9a664f 7771->7830 7773 9a69e3 7775 9a6906 7860 9a6f7d 7775->7860 7778 9a6914 7869 9a6eab 7778->7869 7779 9a6912 7845 9a6cc6 7779->7845 7781 9a6931 7849 9a6ffa 7781->7849 7783 9a693c 7853 9a6d76 7783->7853 7785 9a694e 7786 9a6dd7 56 API calls 7785->7786 7787 9a695e 7786->7787 7788 9a6973 SHGetFolderPathW 7787->7788 7789 9a698c 7788->7789 7789->7793 7882 9a6d3c 7789->7882 7791 9a6998 7792 9a6d3c CharLowerBuffW 7791->7792 7792->7793 7793->7658 7795 9a664f 56 API calls 7794->7795 7796 9a6ddf 7795->7796 7796->7660 7798 9a6ac1 CallUnexpected 7797->7798 7799 9a6ad0 GetModuleFileNameW 7798->7799 7800 9a6aeb 7799->7800 7801 9a6af5 PathRemoveFileSpecW 7799->7801 7802 9a6820 GetLastError 7800->7802 8099 9ab6ca 7801->8099 7819 9a6af0 7802->7819 7805 9a6b31 8108 9a683b 7805->8108 7808 9a6c1c 7808->7663 7808->7666 7810 9a6b63 7812 9ab6ca 41 API calls 7810->7812 7811 9a6b40 7814 9a6eab 41 API calls 7811->7814 7813 9a6b7b 7812->7813 7815 9a6dd7 56 API calls 7813->7815 7814->7819 7816 9a6b89 7815->7816 8114 9a69ee RegOpenKeyExW 7816->8114 7818 9a6b9a 7818->7819 7820 9a6ba0 PathAppendW 7818->7820 8118 9a73ee 7819->8118 7821 9a6bb3 PathAppendW 7820->7821 7822 9a6bc5 7820->7822 7821->7822 7823 9a6bce 7821->7823 7824 9a6820 GetLastError 7822->7824 7825 9a683b 6 API calls 7823->7825 7824->7819 7826 9a6bd9 7825->7826 7826->7819 7827 9a6eab 41 API calls 7826->7827 7827->7819 7829 9a682a 7828->7829 7829->7666 7831 9a667d 7830->7831 7832 9a6666 7830->7832 7887 9a750b EnterCriticalSection 7831->7887 7835 9a750b 6 API calls 7832->7835 7844 9a6678 7832->7844 7834 9a6688 7834->7832 7836 9a6692 GetProcessHeap 7834->7836 7837 9a66cd 7835->7837 7892 9a781d 7836->7892 7839 9a781d 44 API calls 7837->7839 7837->7844 7841 9a671a 7839->7841 7843 9a74c1 __Init_thread_footer 5 API calls 7841->7843 7843->7844 7844->7773 7844->7775 7844->7778 7968 9a6dfe 7845->7968 7847 9a6cd4 PathRemoveFileSpecW 7848 9a6ce3 7847->7848 7848->7781 7850 9a7005 7849->7850 7852 9a7013 7850->7852 7970 9a70a4 7850->7970 7852->7783 7854 9a6d8e 7853->7854 7859 9a6da2 7853->7859 7855 9a6dc3 7854->7855 7857 9a6d9d 7854->7857 7856 9a6eab 41 API calls 7855->7856 7856->7859 7858 9a6ffa 14 API calls 7857->7858 7858->7859 7859->7785 7976 9a7387 EnterCriticalSection 7860->7976 7862 9a6f92 7863 9a6fa8 FindResourceExW 7862->7863 7865 9a7387 5 API calls 7862->7865 7866 9a6fe0 7862->7866 7868 9a6fef 7862->7868 7981 9a6539 LoadResource 7862->7981 7863->7862 7865->7862 7866->7868 7985 9a7118 FindResourceW 7866->7985 7868->7779 7871 9a6ec3 7869->7871 7879 9a6eb9 __InternalCxxFrameHandler 7869->7879 7870 9a6f57 7871->7870 7872 9a6f3d 7871->7872 7873 9a6ef3 7871->7873 7874 9a70a4 14 API calls 7872->7874 7875 9a6f04 7873->7875 7877 9a6f1a 7873->7877 7873->7879 7874->7879 7876 9abaf8 ___std_exception_copy 14 API calls 7875->7876 7878 9a6f09 7876->7878 7877->7879 7880 9abaf8 ___std_exception_copy 14 API calls 7877->7880 7881 9aba3a ___std_exception_copy 41 API calls 7878->7881 7879->7779 7880->7878 7881->7879 7883 9a6d4b 7882->7883 7884 9a6d56 CharLowerBuffW 7883->7884 7886 9a6d6b 7883->7886 7885 9a6d66 7884->7885 7885->7791 7888 9a751f 7887->7888 7889 9a7524 LeaveCriticalSection 7888->7889 7900 9a7593 7888->7900 7889->7834 7905 9a77f0 7892->7905 7895 9a74c1 EnterCriticalSection LeaveCriticalSection 7896 9a755d 7895->7896 7897 9a7568 RtlWakeAllConditionVariable 7896->7897 7898 9a7579 SetEvent ResetEvent 7896->7898 7897->7832 7898->7832 7901 9a75ba LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 7900->7901 7902 9a75a1 SleepConditionVariableCS 7900->7902 7903 9a75de 7901->7903 7902->7903 7903->7888 7906 9a77ff 7905->7906 7907 9a7806 7905->7907 7911 9ac80d 7906->7911 7914 9ac88a 7907->7914 7910 9a66b8 7910->7895 7912 9ac88a 44 API calls 7911->7912 7913 9ac81f 7912->7913 7913->7910 7917 9ac5d6 7914->7917 7918 9ac5e2 CallCatchBlock 7917->7918 7925 9ad642 EnterCriticalSection 7918->7925 7920 9ac5f0 7926 9ac631 7920->7926 7922 9ac5fd 7936 9ac625 7922->7936 7925->7920 7927 9ac64c 7926->7927 7928 9ac6bf _unexpected 7926->7928 7927->7928 7929 9ac69f 7927->7929 7939 9abb26 7927->7939 7928->7922 7929->7928 7931 9abb26 44 API calls 7929->7931 7933 9ac6b5 7931->7933 7932 9ac695 7934 9ad52b __freea 14 API calls 7932->7934 7935 9ad52b __freea 14 API calls 7933->7935 7934->7929 7935->7928 7967 9ad68a LeaveCriticalSection 7936->7967 7938 9ac60e 7938->7910 7940 9abb4e 7939->7940 7941 9abb33 7939->7941 7945 9abb5d 7940->7945 7948 9ad565 7940->7948 7941->7940 7942 9abb3f 7941->7942 7943 9abaf8 ___std_exception_copy 14 API calls 7942->7943 7947 9abb44 CallUnexpected 7943->7947 7955 9ad598 7945->7955 7947->7932 7949 9ad570 7948->7949 7950 9ad585 HeapSize 7948->7950 7951 9abaf8 ___std_exception_copy 14 API calls 7949->7951 7950->7945 7952 9ad575 7951->7952 7953 9aba3a ___std_exception_copy 41 API calls 7952->7953 7954 9ad580 7953->7954 7954->7945 7956 9ad5b0 7955->7956 7957 9ad5a5 7955->7957 7959 9ad5b8 7956->7959 7960 9ad5c1 _unexpected 7956->7960 7958 9afac8 15 API calls 7957->7958 7965 9ad5ad 7958->7965 7963 9ad52b __freea 14 API calls 7959->7963 7961 9ad5eb HeapReAlloc 7960->7961 7962 9ad5c6 7960->7962 7966 9aed5b _unexpected EnterCriticalSection LeaveCriticalSection 7960->7966 7961->7960 7961->7965 7964 9abaf8 ___std_exception_copy 14 API calls 7962->7964 7963->7965 7964->7965 7965->7947 7966->7960 7967->7938 7969 9a6e2f 7968->7969 7971 9a70b6 7970->7971 7975 9a70d9 __InternalCxxFrameHandler 7970->7975 7972 9abaf8 ___std_exception_copy 14 API calls 7971->7972 7973 9a70bf CallUnexpected 7971->7973 7972->7973 7974 9abaf8 14 API calls ___std_exception_copy 7973->7974 7973->7975 7974->7973 7975->7852 7977 9a73a9 LeaveCriticalSection 7976->7977 7978 9a73a0 7976->7978 7977->7862 7978->7977 7991 9a7362 7978->7991 7982 9a656f 7981->7982 7983 9a654f LockResource 7981->7983 7982->7862 7983->7982 7984 9a655c SizeofResource 7983->7984 7984->7982 7986 9a7139 7985->7986 7990 9a7168 7985->7990 7987 9a6539 3 API calls 7986->7987 7988 9a7146 7987->7988 7988->7990 8002 9ab61a 7988->8002 7990->7868 7992 9a736c 7991->7992 7993 9a7371 7992->7993 8001 9a64a0 RaiseException 7992->8001 7993->7977 7995 9a7386 EnterCriticalSection 7998 9a73a9 LeaveCriticalSection 7995->7998 7999 9a73a0 7995->7999 7998->7977 7999->7998 8000 9a7362 RaiseException 7999->8000 8000->7998 8001->7995 8003 9ab62b 8002->8003 8011 9ab627 __InternalCxxFrameHandler 8002->8011 8004 9ab632 8003->8004 8005 9ab645 _wmemset 8003->8005 8006 9abaf8 ___std_exception_copy 14 API calls 8004->8006 8009 9ab67f 8005->8009 8010 9ab676 8005->8010 8005->8011 8007 9ab637 8006->8007 8016 9aba3a 8007->8016 8009->8011 8014 9abaf8 ___std_exception_copy 14 API calls 8009->8014 8012 9abaf8 ___std_exception_copy 14 API calls 8010->8012 8011->7990 8013 9ab67b 8012->8013 8015 9aba3a ___std_exception_copy 41 API calls 8013->8015 8014->8013 8015->8011 8019 9ab986 8016->8019 8020 9ab998 ___std_exception_copy 8019->8020 8025 9ab9bd 8020->8025 8022 9ab9b0 8036 9ab776 8022->8036 8026 9ab9d4 8025->8026 8027 9ab9cd 8025->8027 8033 9ab9e2 8026->8033 8046 9ab7b2 8026->8046 8042 9ab7db GetLastError 8027->8042 8030 9aba09 8030->8033 8049 9aba4a IsProcessorFeaturePresent 8030->8049 8032 9aba39 8034 9ab986 ___std_exception_copy 41 API calls 8032->8034 8033->8022 8035 9aba46 8034->8035 8035->8022 8037 9ab782 8036->8037 8038 9ab799 8037->8038 8081 9ab821 8037->8081 8040 9ab7ac 8038->8040 8041 9ab821 ___std_exception_copy 41 API calls 8038->8041 8040->8011 8041->8040 8043 9ab7f4 8042->8043 8053 9ad442 8043->8053 8047 9ab7bd GetLastError SetLastError 8046->8047 8048 9ab7d6 8046->8048 8047->8030 8048->8030 8050 9aba56 8049->8050 8075 9ab83e 8050->8075 8054 9ad45b 8053->8054 8055 9ad455 8053->8055 8056 9ae941 _unexpected 6 API calls 8054->8056 8074 9ab80c SetLastError 8054->8074 8057 9ae902 _unexpected 6 API calls 8055->8057 8058 9ad475 8056->8058 8057->8054 8059 9ad6d2 _unexpected 14 API calls 8058->8059 8058->8074 8060 9ad485 8059->8060 8061 9ad48d 8060->8061 8062 9ad4a2 8060->8062 8063 9ae941 _unexpected 6 API calls 8061->8063 8064 9ae941 _unexpected 6 API calls 8062->8064 8065 9ad499 8063->8065 8066 9ad4ae 8064->8066 8071 9ad52b __freea 14 API calls 8065->8071 8067 9ad4b2 8066->8067 8068 9ad4c1 8066->8068 8069 9ae941 _unexpected 6 API calls 8067->8069 8070 9ad06e _unexpected 14 API calls 8068->8070 8069->8065 8072 9ad4cc 8070->8072 8071->8074 8073 9ad52b __freea 14 API calls 8072->8073 8073->8074 8074->8026 8076 9ab85a CallUnexpected 8075->8076 8077 9ab886 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 8076->8077 8080 9ab957 CallUnexpected 8077->8080 8078 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8079 9ab975 GetCurrentProcess TerminateProcess 8078->8079 8079->8032 8080->8078 8082 9ab82b 8081->8082 8083 9ab834 8081->8083 8084 9ab7db ___std_exception_copy 16 API calls 8082->8084 8083->8038 8085 9ab830 8084->8085 8085->8083 8088 9acd36 8085->8088 8089 9aeeb2 CallUnexpected EnterCriticalSection LeaveCriticalSection 8088->8089 8090 9acd3b 8089->8090 8091 9acd46 8090->8091 8092 9aeef7 CallUnexpected 40 API calls 8090->8092 8093 9acd6f 8091->8093 8094 9acd50 IsProcessorFeaturePresent 8091->8094 8092->8091 8096 9abfc9 CallUnexpected 23 API calls 8093->8096 8095 9acd5c 8094->8095 8097 9ab83e CallUnexpected 8 API calls 8095->8097 8098 9acd79 8096->8098 8097->8093 8100 9ab6e6 8099->8100 8101 9ab6d8 8099->8101 8102 9abaf8 ___std_exception_copy 14 API calls 8100->8102 8101->8100 8106 9ab700 8101->8106 8103 9ab6f0 8102->8103 8105 9aba3a ___std_exception_copy 41 API calls 8103->8105 8104 9a6b16 PathAppendW 8104->7800 8104->7805 8105->8104 8106->8104 8107 9abaf8 ___std_exception_copy 14 API calls 8106->8107 8107->8103 8109 9a6878 8108->8109 8110 9a6852 8108->8110 8112 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8109->8112 8110->8109 8111 9a6859 GetFileAttributesExW 8110->8111 8111->8109 8113 9a6885 8112->8113 8113->7810 8113->7811 8115 9a6a2b 8114->8115 8117 9a6a1f 8114->8117 8116 9a6a43 SHQueryValueExW 8115->8116 8116->8117 8117->7818 8119 9a73f6 8118->8119 8120 9a73f7 IsProcessorFeaturePresent 8118->8120 8119->7808 8122 9a7acb 8120->8122 8125 9a7a8e SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 8122->8125 8124 9a7bae 8124->7808 8125->8124 8127 9ad25c 8126->8127 8128 9ad256 8126->8128 8132 9ad260 SetLastError 8127->8132 8158 9ae941 8127->8158 8153 9ae902 8128->8153 8136 9accac 8132->8136 8137 9ad2f5 8132->8137 8135 9ad28d 8138 9ad2a6 8135->8138 8139 9ad295 8135->8139 8136->7677 8140 9acd36 CallUnexpected 39 API calls 8137->8140 8142 9ae941 _unexpected 6 API calls 8138->8142 8141 9ae941 _unexpected 6 API calls 8139->8141 8143 9ad2fa 8140->8143 8144 9ad2a3 8141->8144 8145 9ad2b2 8142->8145 8150 9ad52b __freea 14 API calls 8144->8150 8146 9ad2cd 8145->8146 8147 9ad2b6 8145->8147 8170 9ad06e 8146->8170 8149 9ae941 _unexpected 6 API calls 8147->8149 8149->8144 8150->8132 8152 9ad52b __freea 14 API calls 8152->8132 8154 9ae7c1 _unexpected 5 API calls 8153->8154 8155 9ae91e 8154->8155 8156 9ae939 TlsGetValue 8155->8156 8157 9ae927 8155->8157 8157->8127 8159 9ae7c1 _unexpected 5 API calls 8158->8159 8160 9ae95d 8159->8160 8161 9ae97b TlsSetValue 8160->8161 8162 9ad278 8160->8162 8162->8132 8163 9ad6d2 8162->8163 8168 9ad6df _unexpected 8163->8168 8164 9ad71f 8167 9abaf8 ___std_exception_copy 13 API calls 8164->8167 8165 9ad70a HeapAlloc 8166 9ad71d 8165->8166 8165->8168 8166->8135 8167->8166 8168->8164 8168->8165 8175 9aed5b 8168->8175 8189 9acf02 8170->8189 8178 9aed88 8175->8178 8179 9aed94 CallCatchBlock 8178->8179 8184 9ad642 EnterCriticalSection 8179->8184 8181 9aed9f 8185 9aeddb 8181->8185 8184->8181 8188 9ad68a LeaveCriticalSection 8185->8188 8187 9aed66 8187->8168 8188->8187 8190 9acf0e CallCatchBlock 8189->8190 8203 9ad642 EnterCriticalSection 8190->8203 8192 9acf18 8204 9acf48 8192->8204 8195 9ad014 8196 9ad020 CallCatchBlock 8195->8196 8208 9ad642 EnterCriticalSection 8196->8208 8198 9ad02a 8209 9ad1f5 8198->8209 8200 9ad042 8213 9ad062 8200->8213 8203->8192 8207 9ad68a LeaveCriticalSection 8204->8207 8206 9acf36 8206->8195 8207->8206 8208->8198 8210 9ad22b _unexpected 8209->8210 8211 9ad204 _unexpected 8209->8211 8210->8200 8211->8210 8216 9afd0a 8211->8216 8330 9ad68a LeaveCriticalSection 8213->8330 8215 9ad050 8215->8152 8217 9afd8a 8216->8217 8221 9afd20 8216->8221 8219 9ad52b __freea 14 API calls 8217->8219 8243 9afdd8 8217->8243 8220 9afdac 8219->8220 8224 9ad52b __freea 14 API calls 8220->8224 8221->8217 8222 9afd53 8221->8222 8225 9ad52b __freea 14 API calls 8221->8225 8223 9afd75 8222->8223 8231 9ad52b __freea 14 API calls 8222->8231 8227 9ad52b __freea 14 API calls 8223->8227 8226 9afdbf 8224->8226 8230 9afd48 8225->8230 8232 9ad52b __freea 14 API calls 8226->8232 8228 9afd7f 8227->8228 8233 9ad52b __freea 14 API calls 8228->8233 8229 9afe46 8234 9ad52b __freea 14 API calls 8229->8234 8244 9af858 8230->8244 8236 9afd6a 8231->8236 8237 9afdcd 8232->8237 8233->8217 8238 9afe4c 8234->8238 8272 9af956 8236->8272 8241 9ad52b __freea 14 API calls 8237->8241 8238->8210 8239 9afde6 8239->8229 8242 9ad52b 14 API calls __freea 8239->8242 8241->8243 8242->8239 8284 9afe7b 8243->8284 8245 9af869 8244->8245 8271 9af952 8244->8271 8246 9af87a 8245->8246 8247 9ad52b __freea 14 API calls 8245->8247 8248 9af88c 8246->8248 8249 9ad52b __freea 14 API calls 8246->8249 8247->8246 8250 9af89e 8248->8250 8252 9ad52b __freea 14 API calls 8248->8252 8249->8248 8251 9af8b0 8250->8251 8253 9ad52b __freea 14 API calls 8250->8253 8254 9af8c2 8251->8254 8255 9ad52b __freea 14 API calls 8251->8255 8252->8250 8253->8251 8256 9af8d4 8254->8256 8257 9ad52b __freea 14 API calls 8254->8257 8255->8254 8258 9af8e6 8256->8258 8260 9ad52b __freea 14 API calls 8256->8260 8257->8256 8259 9af8f8 8258->8259 8261 9ad52b __freea 14 API calls 8258->8261 8262 9af90a 8259->8262 8263 9ad52b __freea 14 API calls 8259->8263 8260->8258 8261->8259 8264 9ad52b __freea 14 API calls 8262->8264 8265 9af91c 8262->8265 8263->8262 8264->8265 8266 9af92e 8265->8266 8268 9ad52b __freea 14 API calls 8265->8268 8267 9af940 8266->8267 8269 9ad52b __freea 14 API calls 8266->8269 8270 9ad52b __freea 14 API calls 8267->8270 8267->8271 8268->8266 8269->8267 8270->8271 8271->8222 8273 9af963 8272->8273 8283 9af9bb 8272->8283 8274 9af973 8273->8274 8275 9ad52b __freea 14 API calls 8273->8275 8276 9af985 8274->8276 8277 9ad52b __freea 14 API calls 8274->8277 8275->8274 8278 9ad52b __freea 14 API calls 8276->8278 8280 9af997 8276->8280 8277->8276 8278->8280 8279 9af9a9 8282 9ad52b __freea 14 API calls 8279->8282 8279->8283 8280->8279 8281 9ad52b __freea 14 API calls 8280->8281 8281->8279 8282->8283 8283->8223 8285 9afe88 8284->8285 8286 9afea7 8284->8286 8285->8286 8290 9af9e4 8285->8290 8286->8239 8289 9ad52b __freea 14 API calls 8289->8286 8291 9afac2 8290->8291 8292 9af9f5 8290->8292 8291->8289 8326 9af9bf 8292->8326 8295 9af9bf _unexpected 14 API calls 8296 9afa08 8295->8296 8297 9af9bf _unexpected 14 API calls 8296->8297 8298 9afa13 8297->8298 8299 9af9bf _unexpected 14 API calls 8298->8299 8300 9afa1e 8299->8300 8301 9af9bf _unexpected 14 API calls 8300->8301 8302 9afa2c 8301->8302 8303 9ad52b __freea 14 API calls 8302->8303 8304 9afa37 8303->8304 8305 9ad52b __freea 14 API calls 8304->8305 8306 9afa42 8305->8306 8307 9ad52b __freea 14 API calls 8306->8307 8308 9afa4d 8307->8308 8309 9af9bf _unexpected 14 API calls 8308->8309 8310 9afa5b 8309->8310 8311 9af9bf _unexpected 14 API calls 8310->8311 8312 9afa69 8311->8312 8313 9af9bf _unexpected 14 API calls 8312->8313 8314 9afa7a 8313->8314 8315 9af9bf _unexpected 14 API calls 8314->8315 8316 9afa88 8315->8316 8317 9af9bf _unexpected 14 API calls 8316->8317 8318 9afa96 8317->8318 8319 9ad52b __freea 14 API calls 8318->8319 8320 9afaa1 8319->8320 8321 9ad52b __freea 14 API calls 8320->8321 8322 9afaac 8321->8322 8323 9ad52b __freea 14 API calls 8322->8323 8324 9afab7 8323->8324 8325 9ad52b __freea 14 API calls 8324->8325 8325->8291 8327 9af9d1 8326->8327 8328 9af9e0 8327->8328 8329 9ad52b __freea 14 API calls 8327->8329 8328->8295 8329->8327 8330->8215 8332 9ac9e7 ___scrt_uninitialize_crt 8331->8332 8333 9ac9d5 8331->8333 8332->7687 8334 9ac9e3 8333->8334 8336 9af395 8333->8336 8334->7687 8339 9af222 8336->8339 8342 9af176 8339->8342 8343 9af182 CallCatchBlock 8342->8343 8350 9ad642 EnterCriticalSection 8343->8350 8345 9af18c ___scrt_uninitialize_crt 8346 9af1f8 8345->8346 8351 9af0ea 8345->8351 8359 9af216 8346->8359 8350->8345 8352 9af0f6 CallCatchBlock 8351->8352 8362 9af4b2 EnterCriticalSection 8352->8362 8354 9af100 ___scrt_uninitialize_crt 8355 9af14c 8354->8355 8363 9af330 8354->8363 8376 9af16a 8355->8376 8478 9ad68a LeaveCriticalSection 8359->8478 8361 9af204 8361->8334 8362->8354 8364 9af345 ___std_exception_copy 8363->8364 8365 9af34c 8364->8365 8366 9af357 8364->8366 8367 9af222 ___scrt_uninitialize_crt 70 API calls 8365->8367 8379 9af2c7 8366->8379 8375 9af352 8367->8375 8369 9ab776 ___std_exception_copy 41 API calls 8371 9af38f 8369->8371 8371->8355 8373 9af378 8392 9b0f24 8373->8392 8375->8369 8477 9af4c6 LeaveCriticalSection 8376->8477 8378 9af158 8378->8345 8380 9af2e0 8379->8380 8384 9af307 8379->8384 8381 9b065c ___scrt_uninitialize_crt 41 API calls 8380->8381 8380->8384 8382 9af2fc 8381->8382 8403 9b174f 8382->8403 8384->8375 8385 9b065c 8384->8385 8386 9b0668 8385->8386 8387 9b067d 8385->8387 8388 9abaf8 ___std_exception_copy 14 API calls 8386->8388 8387->8373 8389 9b066d 8388->8389 8390 9aba3a ___std_exception_copy 41 API calls 8389->8390 8391 9b0678 8390->8391 8391->8373 8393 9b0f35 8392->8393 8396 9b0f42 8392->8396 8394 9abaf8 ___std_exception_copy 14 API calls 8393->8394 8402 9b0f3a 8394->8402 8395 9b0f8b 8397 9abaf8 ___std_exception_copy 14 API calls 8395->8397 8396->8395 8398 9b0f69 8396->8398 8399 9b0f90 8397->8399 8444 9b0e82 8398->8444 8400 9aba3a ___std_exception_copy 41 API calls 8399->8400 8400->8402 8402->8375 8406 9b175b CallCatchBlock 8403->8406 8404 9b1763 8404->8384 8405 9b181f 8407 9ab9bd ___std_exception_copy 41 API calls 8405->8407 8406->8404 8406->8405 8408 9b17b0 8406->8408 8407->8404 8414 9af701 EnterCriticalSection 8408->8414 8410 9b17b6 8411 9b17d3 8410->8411 8415 9b1857 8410->8415 8441 9b1817 8411->8441 8414->8410 8416 9b187c 8415->8416 8440 9b189f ___scrt_uninitialize_crt 8415->8440 8417 9b1880 8416->8417 8419 9b18de 8416->8419 8418 9ab9bd ___std_exception_copy 41 API calls 8417->8418 8418->8440 8420 9b18f5 8419->8420 8421 9b1f2e ___scrt_uninitialize_crt 43 API calls 8419->8421 8422 9b13db ___scrt_uninitialize_crt 42 API calls 8420->8422 8421->8420 8423 9b18ff 8422->8423 8424 9b1945 8423->8424 8425 9b1905 8423->8425 8426 9b1959 8424->8426 8427 9b19a8 WriteFile 8424->8427 8428 9b192f 8425->8428 8429 9b190c 8425->8429 8432 9b1961 8426->8432 8433 9b1996 8426->8433 8430 9b19ca GetLastError 8427->8430 8427->8440 8431 9b0fa1 ___scrt_uninitialize_crt 47 API calls 8428->8431 8436 9b1373 ___scrt_uninitialize_crt 6 API calls 8429->8436 8429->8440 8430->8440 8431->8440 8434 9b1966 8432->8434 8435 9b1984 8432->8435 8437 9b1459 ___scrt_uninitialize_crt 7 API calls 8433->8437 8439 9b1534 ___scrt_uninitialize_crt 7 API calls 8434->8439 8434->8440 8438 9b161d ___scrt_uninitialize_crt 8 API calls 8435->8438 8436->8440 8437->8440 8438->8440 8439->8440 8440->8411 8442 9af724 ___scrt_uninitialize_crt LeaveCriticalSection 8441->8442 8443 9b181d 8442->8443 8443->8404 8445 9b0e8e CallCatchBlock 8444->8445 8457 9af701 EnterCriticalSection 8445->8457 8447 9b0e9d 8456 9b0ee2 8447->8456 8458 9af7d8 8447->8458 8449 9abaf8 ___std_exception_copy 14 API calls 8451 9b0ee9 8449->8451 8450 9b0ec9 FlushFileBuffers 8450->8451 8452 9b0ed5 GetLastError 8450->8452 8474 9b0f18 8451->8474 8471 9abae5 8452->8471 8456->8449 8457->8447 8459 9af7fa 8458->8459 8460 9af7e5 8458->8460 8463 9abae5 ___scrt_uninitialize_crt 14 API calls 8459->8463 8465 9af81f 8459->8465 8461 9abae5 ___scrt_uninitialize_crt 14 API calls 8460->8461 8462 9af7ea 8461->8462 8464 9abaf8 ___std_exception_copy 14 API calls 8462->8464 8466 9af82a 8463->8466 8468 9af7f2 8464->8468 8465->8450 8467 9abaf8 ___std_exception_copy 14 API calls 8466->8467 8469 9af832 8467->8469 8468->8450 8470 9aba3a ___std_exception_copy 41 API calls 8469->8470 8470->8468 8472 9ad391 ___std_exception_copy 14 API calls 8471->8472 8473 9abaea 8472->8473 8473->8456 8475 9af724 ___scrt_uninitialize_crt LeaveCriticalSection 8474->8475 8476 9b0f01 8475->8476 8476->8402 8477->8378 8478->8361 7478 9a7a3a 7487 9a7d04 GetModuleHandleW 7478->7487 7481 9a7a78 7492 9abfc9 7481->7492 7482 9a7a46 7484 9a7a51 7482->7484 7489 9abfab 7482->7489 7488 9a7a42 7487->7488 7488->7481 7488->7482 7495 9abe30 7489->7495 7493 9abe30 CallUnexpected 23 API calls 7492->7493 7494 9a7a80 7493->7494 7496 9abe6f 7495->7496 7497 9abe5d 7495->7497 7513 9abcd9 7496->7513 7498 9a7d04 CallUnexpected GetModuleHandleW 7497->7498 7500 9abe62 7498->7500 7500->7496 7507 9abf1a GetModuleHandleExW 7500->7507 7502 9abeac 7502->7484 7508 9abf7a 7507->7508 7509 9abf59 GetProcAddress 7507->7509 7511 9abe6e 7508->7511 7512 9abf80 FreeLibrary 7508->7512 7509->7508 7510 9abf6d 7509->7510 7510->7508 7511->7496 7512->7511 7514 9abce5 CallCatchBlock 7513->7514 7528 9ad642 EnterCriticalSection 7514->7528 7516 9abcef 7529 9abd45 7516->7529 7518 9abcfc 7533 9abd1a 7518->7533 7521 9abec7 7590 9abef8 7521->7590 7524 9abee5 7526 9abf1a CallUnexpected 3 API calls 7524->7526 7525 9abed5 GetCurrentProcess TerminateProcess 7525->7524 7527 9abeed ExitProcess 7526->7527 7528->7516 7530 9abd51 CallCatchBlock 7529->7530 7532 9abdb8 CallUnexpected 7530->7532 7536 9ac823 7530->7536 7532->7518 7589 9ad68a LeaveCriticalSection 7533->7589 7535 9abd08 7535->7502 7535->7521 7537 9ac82f __EH_prolog3 7536->7537 7540 9ac57b 7537->7540 7539 9ac856 CallUnexpected 7539->7532 7541 9ac587 CallCatchBlock 7540->7541 7548 9ad642 EnterCriticalSection 7541->7548 7543 9ac595 7549 9ac733 7543->7549 7548->7543 7550 9ac752 7549->7550 7551 9ac5a2 7549->7551 7550->7551 7556 9ad52b 7550->7556 7553 9ac5ca 7551->7553 7588 9ad68a LeaveCriticalSection 7553->7588 7555 9ac5b3 7555->7539 7557 9ad560 7556->7557 7558 9ad536 HeapFree 7556->7558 7557->7551 7558->7557 7559 9ad54b GetLastError 7558->7559 7560 9ad558 __freea 7559->7560 7562 9abaf8 7560->7562 7565 9ad391 GetLastError 7562->7565 7564 9abafd 7564->7557 7566 9ad3ad 7565->7566 7567 9ad3a7 7565->7567 7569 9ae941 _unexpected 6 API calls 7566->7569 7571 9ad3b1 SetLastError 7566->7571 7568 9ae902 _unexpected 6 API calls 7567->7568 7568->7566 7570 9ad3c9 7569->7570 7570->7571 7573 9ad6d2 _unexpected 12 API calls 7570->7573 7571->7564 7574 9ad3de 7573->7574 7575 9ad3e6 7574->7575 7576 9ad3f7 7574->7576 7577 9ae941 _unexpected 6 API calls 7575->7577 7578 9ae941 _unexpected 6 API calls 7576->7578 7580 9ad3f4 7577->7580 7579 9ad403 7578->7579 7581 9ad41e 7579->7581 7582 9ad407 7579->7582 7585 9ad52b __freea 12 API calls 7580->7585 7583 9ad06e _unexpected 12 API calls 7581->7583 7584 9ae941 _unexpected 6 API calls 7582->7584 7586 9ad429 7583->7586 7584->7580 7585->7571 7587 9ad52b __freea 12 API calls 7586->7587 7587->7571 7588->7555 7589->7535 7595 9ad6a1 GetPEB 7590->7595 7593 9abf02 GetPEB 7594 9abed1 7593->7594 7594->7524 7594->7525 7596 9ad6bb 7595->7596 7598 9abefd 7595->7598 7599 9ae844 7596->7599 7598->7593 7598->7594 7602 9ae7c1 7599->7602 7603 9ae7ef 7602->7603 7607 9ae7eb 7602->7607 7603->7607 7609 9ae6f6 7603->7609 7606 9ae809 GetProcAddress 7606->7607 7608 9ae819 _unexpected 7606->7608 7607->7598 7608->7607 7615 9ae707 ___vcrt_FlsGetValue 7609->7615 7610 9ae79d 7610->7606 7610->7607 7611 9ae725 LoadLibraryExW 7612 9ae740 GetLastError 7611->7612 7613 9ae7a4 7611->7613 7612->7615 7613->7610 7614 9ae7b6 FreeLibrary 7613->7614 7614->7610 7615->7610 7615->7611 7616 9ae773 LoadLibraryExW 7615->7616 7616->7613 7616->7615 9543 9aa53a 9544 9aa551 9543->9544 9545 9acd36 CallUnexpected 41 API calls 9544->9545 9546 9aa556 CallCatchBlock 9545->9546 9547 9aa419 __InternalCxxFrameHandler 41 API calls 9546->9547 9548 9aa58b __InternalCxxFrameHandler ___AdjustPointer 9547->9548 9549 9b453b 9550 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9549->9550 9551 9b454f 9550->9551 9552 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9551->9552 9553 9b4559 9552->9553 8634 9aeab8 GetStartupInfoW 8635 9aeade 8634->8635 8636 9aeb72 8634->8636 8635->8636 8640 9af663 8635->8640 8638 9aeb06 8638->8636 8639 9aeb36 GetFileType 8638->8639 8639->8638 8641 9af66f CallCatchBlock 8640->8641 8642 9af678 8641->8642 8643 9af699 8641->8643 8645 9abaf8 ___std_exception_copy 14 API calls 8642->8645 8653 9ad642 EnterCriticalSection 8643->8653 8646 9af67d 8645->8646 8647 9aba3a ___std_exception_copy 41 API calls 8646->8647 8649 9af687 8647->8649 8648 9af6d1 8661 9af6f8 8648->8661 8649->8638 8650 9af6a5 8650->8648 8654 9af5b3 8650->8654 8653->8650 8655 9ad6d2 _unexpected 14 API calls 8654->8655 8658 9af5c5 8655->8658 8656 9af5d2 8657 9ad52b __freea 14 API calls 8656->8657 8659 9af627 8657->8659 8658->8656 8660 9ae983 6 API calls 8658->8660 8659->8650 8660->8658 8664 9ad68a LeaveCriticalSection 8661->8664 8663 9af6ff 8663->8649 8664->8663 9554 9aad3f 9557 9ab2b7 9554->9557 9558 9aad4e 9557->9558 9559 9ab2c4 9557->9559 9560 9abb0b ___std_exception_destroy 14 API calls 9559->9560 9560->9558 8665 9ac8bd 8666 9ad52b __freea 14 API calls 8665->8666 8667 9ac8cb 8666->8667 8668 9ad52b __freea 14 API calls 8667->8668 8669 9ac8de 8668->8669 8670 9ad52b __freea 14 API calls 8669->8670 8671 9ac8ef 8670->8671 8672 9ad52b __freea 14 API calls 8671->8672 8673 9ac900 8672->8673 8674 9a65b2 HeapAlloc 9561 9aae32 9562 9a9b24 CallUnexpected 51 API calls 9561->9562 9563 9aae3a __FrameHandler3::FrameUnwindToState 9562->9563 9564 9ab001 __FrameHandler3::FrameUnwindToState 51 API calls 9563->9564 9565 9aaeab 9564->9565 9566 9aaee4 CallCatchBlock 54 API calls 9565->9566 9567 9aaecc 9566->9567 8675 9ad9b3 8676 9ad9de 8675->8676 8677 9ada2c FindFirstFileExW 8676->8677 8678 9ada0d 8676->8678 8677->8678 8681 9ada63 8677->8681 8679 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8678->8679 8682 9adb27 8679->8682 8680 9adac1 FindNextFileW 8680->8681 8683 9adad6 8680->8683 8681->8680 8684 9adb0d FindClose 8681->8684 8685 9adaea FindClose 8683->8685 8688 9b0690 8683->8688 8684->8678 8685->8678 8689 9b06ca 8688->8689 8690 9abaf8 ___std_exception_copy 14 API calls 8689->8690 8695 9b06de 8689->8695 8691 9b06d3 8690->8691 8692 9aba3a ___std_exception_copy 41 API calls 8691->8692 8692->8695 8693 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8694 9adb08 8693->8694 8694->8685 8695->8693 8696 9a97b0 8697 9a97ce __InternalCxxFrameHandler 8696->8697 8708 9a9770 8697->8708 8709 9a978f 8708->8709 8710 9a9782 8708->8710 8711 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8710->8711 8711->8709 9568 9b2a30 9571 9b2a4e 9568->9571 9570 9b2a46 9575 9b2a53 9571->9575 9572 9b3313 15 API calls 9573 9b2c7f 9572->9573 9573->9570 9574 9b2ae8 9574->9570 9575->9572 9575->9574 9576 9ac934 9579 9ac525 9576->9579 9578 9ac939 9580 9ac531 __EH_prolog3 9579->9580 9589 9ac4ef 9580->9589 9587 9ac4c0 14 API calls 9588 9ac568 CallUnexpected 9587->9588 9588->9578 9590 9ac507 9589->9590 9591 9ac501 9589->9591 9593 9ac50a 9590->9593 9592 9ac4c0 14 API calls 9591->9592 9592->9590 9594 9ac51c 9593->9594 9595 9ac522 9593->9595 9596 9ac4c0 14 API calls 9594->9596 9597 9ac4c0 9595->9597 9596->9595 9601 9ac4cd 9597->9601 9602 9ac4ea 9597->9602 9598 9ac4e4 9600 9ad52b __freea 14 API calls 9598->9600 9599 9ad52b __freea 14 API calls 9599->9601 9600->9602 9601->9598 9601->9599 9602->9587 8712 9b44aa 8713 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8712->8713 8714 9b44bb 8713->8714 8715 9adbab 8716 9adbc8 8715->8716 8717 9adbb8 8715->8717 8719 9ad52b __freea 14 API calls 8716->8719 8717->8716 8718 9ad52b __freea 14 API calls 8717->8718 8718->8717 8720 9adbd0 8719->8720 8721 9af5a8 8722 9af4da 8721->8722 8723 9af508 8722->8723 8726 9af4f4 8722->8726 8728 9af532 8722->8728 8724 9abaf8 ___std_exception_copy 14 API calls 8725 9af4fe 8724->8725 8727 9aba3a ___std_exception_copy 41 API calls 8725->8727 8726->8723 8726->8724 8727->8723 8728->8723 8729 9abaf8 ___std_exception_copy 14 API calls 8728->8729 8729->8725 9603 9b0929 9604 9b06de 9603->9604 9605 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9604->9605 9606 9b06eb 9605->9606 9607 9aae28 9610 9aaf9f 9607->9610 9609 9aae30 9611 9aafe5 9610->9611 9612 9aafaf 9610->9612 9611->9609 9612->9611 9613 9a9b24 CallUnexpected 51 API calls 9612->9613 9614 9aafdb 9613->9614 9614->9609 8734 9aa2a9 8735 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8734->8735 8736 9aa2bb 8735->8736 8739 9aabde 8736->8739 8740 9aabec ___except_validate_context_record 8739->8740 8741 9a9b24 CallUnexpected 51 API calls 8740->8741 8742 9aabf2 8741->8742 8743 9aac31 8742->8743 8746 9aac57 8742->8746 8747 9aa2d4 8742->8747 8743->8747 8748 9aafe9 8743->8748 8746->8747 8751 9aa670 8746->8751 8801 9ab001 8748->8801 8750 9aaffc 8750->8747 8755 9aa690 __FrameHandler3::FrameUnwindToState 8751->8755 8752 9aa9a8 8753 9acd36 CallUnexpected 41 API calls 8752->8753 8764 9aa9ae 8752->8764 8754 9aaa19 8753->8754 8755->8752 8758 9aa772 8755->8758 8761 9a9b24 CallUnexpected 51 API calls 8755->8761 8756 9aa97d 8756->8752 8757 9aa97b 8756->8757 8830 9aaa1a 8756->8830 8760 9a9b24 CallUnexpected 51 API calls 8757->8760 8758->8756 8759 9aa7fb 8758->8759 8800 9aa778 type_info::operator== 8758->8800 8769 9aa913 __InternalCxxFrameHandler 8759->8769 8815 9aa063 8759->8815 8760->8752 8763 9aa6f2 8761->8763 8763->8764 8766 9a9b24 CallUnexpected 51 API calls 8763->8766 8764->8747 8768 9aa700 8766->8768 8767 9aa81c ___TypeMatch 8767->8769 8820 9aa5f0 8767->8820 8772 9a9b24 CallUnexpected 51 API calls 8768->8772 8769->8757 8770 9aa96c 8769->8770 8771 9aa957 8769->8771 8775 9ab0e9 IsInExceptionSpec 41 API calls 8770->8775 8773 9a9b24 CallUnexpected 51 API calls 8771->8773 8774 9aa708 8772->8774 8776 9aa95c 8773->8776 8774->8752 8780 9a9b24 CallUnexpected 51 API calls 8774->8780 8777 9aa975 8775->8777 8778 9a9b24 CallUnexpected 51 API calls 8776->8778 8777->8757 8779 9aa9d8 8777->8779 8778->8800 8781 9a9b24 CallUnexpected 51 API calls 8779->8781 8784 9aa751 8780->8784 8782 9aa9dd 8781->8782 8785 9a9b24 CallUnexpected 51 API calls 8782->8785 8783 9acc9b _unexpected 41 API calls 8794 9aa9b8 __InternalCxxFrameHandler 8783->8794 8784->8758 8787 9a9b24 CallUnexpected 51 API calls 8784->8787 8786 9aa9e5 8785->8786 8850 9aa256 RtlUnwind 8786->8850 8788 9aa75b 8787->8788 8789 9a9b24 CallUnexpected 51 API calls 8788->8789 8792 9aa766 8789->8792 8810 9ab0e9 8792->8810 8793 9aa9f9 8796 9aafe9 __InternalCxxFrameHandler 51 API calls 8793->8796 8847 9ab2d6 8794->8847 8797 9aaa05 __InternalCxxFrameHandler 8796->8797 8851 9aaf60 8797->8851 8800->8783 8800->8794 8802 9ab00d __FrameHandler3::FrameUnwindToState CallCatchBlock 8801->8802 8803 9a9b24 CallUnexpected 51 API calls 8802->8803 8804 9ab028 __CallSettingFrame@12 __FrameHandler3::FrameUnwindToState 8803->8804 8805 9ab0a8 8804->8805 8806 9ab0cf __FrameHandler3::FrameUnwindToState 51 API calls 8804->8806 8807 9acd36 CallUnexpected 41 API calls 8805->8807 8809 9ab0ad __FrameHandler3::FrameUnwindToState 8805->8809 8806->8805 8808 9ab0e8 8807->8808 8809->8750 8811 9ab17d 8810->8811 8814 9ab0fd ___TypeMatch 8810->8814 8812 9acd36 CallUnexpected 41 API calls 8811->8812 8813 9ab182 8812->8813 8814->8758 8818 9aa081 8815->8818 8816 9aa0b7 8816->8767 8817 9acd36 CallUnexpected 41 API calls 8819 9aa0d2 8817->8819 8818->8816 8818->8817 8821 9aa60f 8820->8821 8822 9aa602 8820->8822 8867 9aa256 RtlUnwind 8821->8867 8863 9aa557 8822->8863 8825 9aa624 8826 9ab001 __FrameHandler3::FrameUnwindToState 51 API calls 8825->8826 8827 9aa635 __FrameHandler3::FrameUnwindToState 8826->8827 8868 9aad9c 8827->8868 8829 9aa65d __InternalCxxFrameHandler 8829->8767 8831 9aaa30 8830->8831 8841 9aab45 8830->8841 8832 9a9b24 CallUnexpected 51 API calls 8831->8832 8833 9aaa37 8832->8833 8834 9aaa3e EncodePointer 8833->8834 8845 9aaa79 8833->8845 8835 9a9b24 CallUnexpected 51 API calls 8834->8835 8842 9aaa4c 8835->8842 8836 9aab4a 8839 9acd36 CallUnexpected 41 API calls 8836->8839 8837 9aaa96 8838 9aa063 __InternalCxxFrameHandler 41 API calls 8837->8838 8844 9aaaad 8838->8844 8840 9aab4f 8839->8840 8841->8757 8843 9aa130 __InternalCxxFrameHandler 51 API calls 8842->8843 8842->8845 8843->8845 8844->8841 8846 9aa5f0 __InternalCxxFrameHandler 53 API calls 8844->8846 8845->8836 8845->8837 8845->8841 8846->8844 8848 9ab31d RaiseException 8847->8848 8849 9ab2f0 8847->8849 8848->8779 8849->8848 8850->8793 8852 9aaf6c __EH_prolog3_catch 8851->8852 8853 9a9b24 CallUnexpected 51 API calls 8852->8853 8854 9aaf71 8853->8854 8855 9aaf94 8854->8855 8930 9ab20c 8854->8930 8857 9acd36 CallUnexpected 41 API calls 8855->8857 8859 9aaf99 8857->8859 8864 9aa563 CallCatchBlock 8863->8864 8882 9aa419 8864->8882 8866 9aa58b __InternalCxxFrameHandler ___AdjustPointer 8866->8821 8867->8825 8869 9aada8 CallCatchBlock 8868->8869 8889 9aa2da 8869->8889 8872 9a9b24 CallUnexpected 51 API calls 8873 9aadd4 8872->8873 8874 9a9b24 CallUnexpected 51 API calls 8873->8874 8875 9aaddf 8874->8875 8876 9a9b24 CallUnexpected 51 API calls 8875->8876 8877 9aadea 8876->8877 8878 9a9b24 CallUnexpected 51 API calls 8877->8878 8879 9aadf2 CallCatchBlock 8878->8879 8894 9aaee4 8879->8894 8881 9aaecc 8881->8829 8883 9aa425 CallCatchBlock 8882->8883 8884 9acd36 CallUnexpected 41 API calls 8883->8884 8885 9aa4a0 __InternalCxxFrameHandler ___AdjustPointer 8883->8885 8886 9aa556 CallCatchBlock 8884->8886 8885->8866 8887 9aa419 __InternalCxxFrameHandler 41 API calls 8886->8887 8888 9aa58b __InternalCxxFrameHandler ___AdjustPointer 8887->8888 8888->8866 8890 9a9b24 CallUnexpected 51 API calls 8889->8890 8891 9aa2eb 8890->8891 8892 9a9b24 CallUnexpected 51 API calls 8891->8892 8893 9aa2f6 8892->8893 8893->8872 8903 9aa2fe 8894->8903 8896 9aaef5 8897 9a9b24 CallUnexpected 51 API calls 8896->8897 8898 9aaefb 8897->8898 8899 9a9b24 CallUnexpected 51 API calls 8898->8899 8901 9aaf06 8899->8901 8900 9aaf47 __InternalCxxFrameHandler 8900->8881 8901->8900 8922 9a9a14 8901->8922 8904 9a9b24 CallUnexpected 51 API calls 8903->8904 8905 9aa307 8904->8905 8906 9aa30f 8905->8906 8907 9aa31d 8905->8907 8908 9a9b24 CallUnexpected 51 API calls 8906->8908 8909 9a9b24 CallUnexpected 51 API calls 8907->8909 8910 9aa317 8908->8910 8911 9aa322 8909->8911 8910->8896 8911->8910 8912 9acd36 CallUnexpected 41 API calls 8911->8912 8913 9aa345 8912->8913 8914 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8913->8914 8915 9aa35a 8914->8915 8916 9aa365 8915->8916 8917 9aabde __InternalCxxFrameHandler 54 API calls 8915->8917 8916->8896 8918 9aa39d 8917->8918 8919 9aa3b4 8918->8919 8925 9aa256 RtlUnwind 8918->8925 8926 9aa130 8919->8926 8923 9a9b24 CallUnexpected 51 API calls 8922->8923 8924 9a9a1c 8923->8924 8924->8900 8925->8919 8927 9aa152 __InternalCxxFrameHandler 8926->8927 8929 9aa140 8926->8929 8928 9a9b24 CallUnexpected 51 API calls 8927->8928 8928->8929 8929->8916 8931 9a9b24 CallUnexpected 51 API calls 8930->8931 8932 9ab212 8931->8932 8933 9acc9b _unexpected 41 API calls 8932->8933 8934 9ab228 8933->8934 9615 9b212f 9617 9b2138 9615->9617 9616 9b21a0 9619 9b31ce 9616->9619 9620 9b32d7 20 API calls 9616->9620 9617->9616 9618 9b215f 9617->9618 9618->9619 9622 9b32d7 20 API calls 9618->9622 9621 9b21ee 9620->9621 9623 9b31fe 9622->9623 9624 9a662d 9627 9a6596 9624->9627 9626 9a6638 _AnonymousOriginator 9628 9a65a2 9627->9628 9629 9a65b1 9627->9629 9628->9629 9630 9a65a8 HeapDestroy 9628->9630 9629->9626 9630->9629 9631 9a9d20 9632 9a9d32 9631->9632 9634 9a9d40 9631->9634 9633 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9632->9633 9633->9634 8935 9ad9a6 8936 9aba4a ___std_exception_copy 11 API calls 8935->8936 8937 9ad9b2 8936->8937 8938 9ada2c FindFirstFileExW 8937->8938 8939 9ada0d 8937->8939 8938->8939 8943 9ada63 8938->8943 8940 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 8939->8940 8942 9adb27 8940->8942 8941 9adac1 FindNextFileW 8941->8943 8944 9adad6 8941->8944 8943->8941 8945 9adb0d FindClose 8943->8945 8946 9adaea FindClose 8944->8946 8947 9b0690 41 API calls 8944->8947 8945->8939 8946->8939 8948 9adb08 8947->8948 8948->8946 8949 9aeaa6 GetProcessHeap 9635 9a7a26 9638 9abb93 9635->9638 9639 9ad391 ___std_exception_copy 14 API calls 9638->9639 9640 9a7a37 9639->9640 9641 9aec27 9642 9aec33 CallCatchBlock 9641->9642 9653 9ad642 EnterCriticalSection 9642->9653 9644 9aec3a 9645 9af663 42 API calls 9644->9645 9646 9aec49 9645->9646 9647 9aec58 9646->9647 9654 9aeac1 GetStartupInfoW 9646->9654 9665 9aec7e 9647->9665 9653->9644 9655 9aeade 9654->9655 9656 9aeb72 9654->9656 9655->9656 9657 9af663 42 API calls 9655->9657 9660 9aeb77 9656->9660 9659 9aeb06 9657->9659 9658 9aeb36 GetFileType 9658->9659 9659->9656 9659->9658 9662 9aeb7e 9660->9662 9661 9aebc1 GetStdHandle 9661->9662 9662->9661 9663 9aec23 9662->9663 9664 9aebd4 GetFileType 9662->9664 9663->9647 9664->9662 9668 9ad68a LeaveCriticalSection 9665->9668 9667 9aec69 9668->9667 9672 9a7d53 9673 9a7d8a 9672->9673 9674 9a7d65 9672->9674 9674->9673 9681 9a9ab5 9674->9681 9679 9acc9b _unexpected 41 API calls 9680 9a7da8 9679->9680 9682 9a9b24 CallUnexpected 51 API calls 9681->9682 9683 9a7d97 9682->9683 9684 9a9abe 9683->9684 9685 9a9b24 CallUnexpected 51 API calls 9684->9685 9686 9a7da1 9685->9686 9686->9679 8950 9a72d6 8951 9a72de 8950->8951 8957 9a6511 InitializeCriticalSectionAndSpinCount 8951->8957 8954 9a7309 IsDebuggerPresent 8955 9a731e 8954->8955 8956 9a7313 OutputDebugStringW 8954->8956 8956->8955 8958 9a6520 GetLastError 8957->8958 8959 9a652c 8957->8959 8958->8959 8959->8954 8959->8955 8960 9acbd6 8963 9acb5d 8960->8963 8964 9acb69 CallCatchBlock 8963->8964 8971 9ad642 EnterCriticalSection 8964->8971 8966 9acba1 8976 9acbbf 8966->8976 8967 9acb73 8967->8966 8972 9affd7 8967->8972 8971->8967 8973 9affe5 _unexpected 8972->8973 8975 9afff2 8972->8975 8974 9afd0a _unexpected 14 API calls 8973->8974 8973->8975 8974->8975 8975->8967 8979 9ad68a LeaveCriticalSection 8976->8979 8978 9acbad 8979->8978 9687 9b0a49 9690 9b06de 9687->9690 9688 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9689 9b06eb 9688->9689 9690->9688 9690->9690 9691 9ac34e 9704 9ae674 GetEnvironmentStringsW 9691->9704 9693 9ac35f 9694 9ac371 9693->9694 9695 9ac365 9693->9695 9711 9ac3a2 9694->9711 9696 9ad52b __freea 14 API calls 9695->9696 9698 9ac36b 9696->9698 9700 9ad52b __freea 14 API calls 9701 9ac395 9700->9701 9702 9ad52b __freea 14 API calls 9701->9702 9703 9ac39b 9702->9703 9705 9ae683 9704->9705 9706 9ae685 9704->9706 9705->9693 9707 9afac8 15 API calls 9706->9707 9708 9ae69a __InternalCxxFrameHandler 9707->9708 9709 9ad52b __freea 14 API calls 9708->9709 9710 9ae6b4 FreeEnvironmentStringsW 9709->9710 9710->9693 9714 9ac3c1 9711->9714 9712 9ad6d2 _unexpected 14 API calls 9713 9ac401 9712->9713 9715 9ac409 9713->9715 9727 9ac413 9713->9727 9714->9712 9714->9714 9716 9ad52b __freea 14 API calls 9715->9716 9719 9ac378 9716->9719 9717 9ac488 9718 9ad52b __freea 14 API calls 9717->9718 9718->9719 9719->9700 9720 9ad6d2 _unexpected 14 API calls 9720->9727 9721 9ac498 9722 9ac4c0 14 API calls 9721->9722 9724 9ac49e 9722->9724 9723 9ab6ca 41 API calls 9723->9727 9725 9ad52b __freea 14 API calls 9724->9725 9728 9ac4a6 9725->9728 9726 9ac4b3 9729 9aba4a ___std_exception_copy 11 API calls 9726->9729 9727->9717 9727->9720 9727->9721 9727->9723 9727->9726 9730 9ad52b __freea 14 API calls 9727->9730 9731 9ad52b __freea 14 API calls 9728->9731 9732 9ac4bf 9729->9732 9730->9727 9731->9719 9733 9a734c DeleteCriticalSection 9734 9a73cc 9733->9734 9735 9abb0b ___std_exception_destroy 14 API calls 9734->9735 9736 9a73db 9734->9736 9735->9736 9737 9a704d 9738 9a705e 9737->9738 9740 9a706f 9738->9740 9741 9a71bf 9738->9741 9742 9a71de 9741->9742 9743 9a7233 9742->9743 9744 9a70a4 14 API calls 9742->9744 9745 9a720a 9744->9745 9745->9740 9746 9a7840 9747 9a7848 9746->9747 9763 9acb20 9747->9763 9749 9a7853 9750 9a7690 4 API calls 9749->9750 9753 9a7868 __RTC_Initialize 9750->9753 9751 9a7bb0 4 API calls 9752 9a78ea 9751->9752 9754 9a781d 44 API calls 9753->9754 9761 9a78c5 9753->9761 9755 9a7881 9754->9755 9755->9761 9770 9a8083 InitializeSListHead 9755->9770 9757 9a7897 9771 9a8092 9757->9771 9759 9a78ba 9777 9acbfd 9759->9777 9761->9751 9762 9a78e2 9761->9762 9764 9acb2f 9763->9764 9765 9acb52 9763->9765 9764->9765 9766 9abaf8 ___std_exception_copy 14 API calls 9764->9766 9765->9749 9767 9acb42 9766->9767 9768 9aba3a ___std_exception_copy 41 API calls 9767->9768 9769 9acb4d 9768->9769 9769->9749 9770->9757 9784 9accd7 9771->9784 9773 9a80a3 9774 9a80aa 9773->9774 9775 9a7bb0 4 API calls 9773->9775 9774->9759 9776 9a80b2 9775->9776 9778 9ad240 _unexpected 41 API calls 9777->9778 9780 9acc08 9778->9780 9779 9acc40 9779->9761 9780->9779 9781 9abaf8 ___std_exception_copy 14 API calls 9780->9781 9782 9acc35 9781->9782 9783 9aba3a ___std_exception_copy 41 API calls 9782->9783 9783->9779 9786 9accf5 9784->9786 9789 9acd15 9784->9789 9785 9abaf8 ___std_exception_copy 14 API calls 9787 9acd0b 9785->9787 9786->9785 9788 9aba3a ___std_exception_copy 41 API calls 9787->9788 9788->9789 9789->9773 8983 9accc7 8984 9accca 8983->8984 8985 9acd36 CallUnexpected 41 API calls 8984->8985 8986 9accd6 8985->8986 8987 9a65c7 8988 9a65de 8987->8988 8989 9a65d0 HeapFree 8987->8989 8989->8988 8990 9a73fc 9001 9a7423 InitializeCriticalSectionAndSpinCount GetModuleHandleW 8990->9001 8992 9a7401 9012 9a7690 8992->9012 8994 9a7408 8995 9a741b 8994->8995 8996 9a740d 8994->8996 8998 9a7bb0 4 API calls 8995->8998 8997 9a781d 44 API calls 8996->8997 8999 9a7417 8997->8999 9000 9a7422 8998->9000 9002 9a7446 GetModuleHandleW 9001->9002 9003 9a7457 GetProcAddress GetProcAddress 9001->9003 9002->9003 9004 9a749d 9002->9004 9005 9a7487 CreateEventW 9003->9005 9006 9a7475 9003->9006 9008 9a7bb0 4 API calls 9004->9008 9005->9004 9007 9a7479 9005->9007 9006->9005 9006->9007 9007->8992 9009 9a74a4 DeleteCriticalSection 9008->9009 9010 9a74b9 CloseHandle 9009->9010 9011 9a74c0 9009->9011 9010->9011 9011->8992 9013 9a769c 9012->9013 9014 9a76a0 9012->9014 9013->8994 9015 9a7bb0 4 API calls 9014->9015 9017 9a76ad ___scrt_release_startup_lock 9014->9017 9016 9a7716 9015->9016 9017->8994 9018 9a78f3 9023 9a7d47 SetUnhandledExceptionFilter 9018->9023 9020 9a78f8 9024 9acc66 9020->9024 9022 9a7903 9023->9020 9025 9acc8c 9024->9025 9026 9acc72 9024->9026 9025->9022 9026->9025 9027 9abaf8 ___std_exception_copy 14 API calls 9026->9027 9028 9acc7c 9027->9028 9029 9aba3a ___std_exception_copy 41 API calls 9028->9029 9030 9acc87 9029->9030 9030->9022 9790 9ac973 9793 9ac98a 9790->9793 9794 9ac986 9793->9794 9795 9ac99e 9793->9795 9795->9794 9796 9ad52b __freea 14 API calls 9795->9796 9796->9794 9031 9b21f1 9032 9b2215 9031->9032 9033 9b222e 9032->9033 9035 9b3507 __startOneArgErrorHandling 9032->9035 9036 9b2278 9033->9036 9039 9b3313 9033->9039 9038 9b3549 __startOneArgErrorHandling 9035->9038 9047 9b38a1 9035->9047 9040 9b3336 9039->9040 9041 9b3326 DecodePointer 9039->9041 9042 9b3365 9040->9042 9043 9b337a 9040->9043 9044 9b33c1 9040->9044 9041->9040 9042->9044 9045 9abaf8 ___std_exception_copy 14 API calls 9042->9045 9043->9044 9046 9abaf8 ___std_exception_copy 14 API calls 9043->9046 9044->9036 9045->9044 9046->9044 9048 9b38da __startOneArgErrorHandling 9047->9048 9050 9b3901 __startOneArgErrorHandling 9048->9050 9058 9b3c0b 9048->9058 9051 9b3944 9050->9051 9053 9b391f 9050->9053 9070 9b3f01 9051->9070 9062 9b3f30 9053->9062 9055 9b393f __startOneArgErrorHandling 9056 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9055->9056 9057 9b3968 9056->9057 9057->9038 9059 9b3c36 __raise_exc 9058->9059 9060 9b3e2f RaiseException 9059->9060 9061 9b3e48 9060->9061 9061->9050 9063 9b3f3d 9062->9063 9064 9b3f4c __startOneArgErrorHandling 9063->9064 9065 9b3f7b __startOneArgErrorHandling 9063->9065 9066 9b3f01 __startOneArgErrorHandling 14 API calls 9064->9066 9068 9b3fc9 9065->9068 9069 9b3f01 __startOneArgErrorHandling 14 API calls 9065->9069 9067 9b3f65 9066->9067 9067->9055 9068->9055 9069->9068 9071 9b3f0e 9070->9071 9072 9b3f23 9070->9072 9074 9b3f28 9071->9074 9075 9abaf8 ___std_exception_copy 14 API calls 9071->9075 9073 9abaf8 ___std_exception_copy 14 API calls 9072->9073 9073->9074 9074->9055 9076 9b3f1b 9075->9076 9076->9055 9797 9aea70 9798 9aea7b 9797->9798 9800 9aeaa1 9797->9800 9799 9aea8b FreeLibrary 9798->9799 9798->9800 9799->9798 9077 9ae4f1 GetCommandLineA GetCommandLineW 9078 9b0df7 9081 9ae20d 9078->9081 9082 9ae248 9081->9082 9083 9ae216 9081->9083 9087 9ad2fb 9083->9087 9088 9ad30c 9087->9088 9089 9ad306 9087->9089 9091 9ae941 _unexpected 6 API calls 9088->9091 9108 9ad312 9088->9108 9090 9ae902 _unexpected 6 API calls 9089->9090 9090->9088 9092 9ad326 9091->9092 9094 9ad6d2 _unexpected 14 API calls 9092->9094 9092->9108 9093 9acd36 CallUnexpected 41 API calls 9096 9ad390 9093->9096 9095 9ad336 9094->9095 9097 9ad33e 9095->9097 9098 9ad353 9095->9098 9099 9ae941 _unexpected 6 API calls 9097->9099 9100 9ae941 _unexpected 6 API calls 9098->9100 9101 9ad34a 9099->9101 9102 9ad35f 9100->9102 9105 9ad52b __freea 14 API calls 9101->9105 9103 9ad372 9102->9103 9104 9ad363 9102->9104 9107 9ad06e _unexpected 14 API calls 9103->9107 9106 9ae941 _unexpected 6 API calls 9104->9106 9105->9108 9106->9101 9109 9ad37d 9107->9109 9108->9093 9111 9ad317 9108->9111 9110 9ad52b __freea 14 API calls 9109->9110 9110->9111 9112 9ae018 9111->9112 9135 9ae16d 9112->9135 9117 9ae05b 9117->9082 9119 9ae06c 9120 9ae082 9119->9120 9121 9ae074 9119->9121 9160 9ae268 9120->9160 9123 9ad52b __freea 14 API calls 9121->9123 9123->9117 9125 9ae0ba 9127 9abaf8 ___std_exception_copy 14 API calls 9125->9127 9126 9ae0d5 9129 9ae101 9126->9129 9133 9ad52b __freea 14 API calls 9126->9133 9128 9ae0bf 9127->9128 9130 9ad52b __freea 14 API calls 9128->9130 9134 9ae14a 9129->9134 9171 9adc8a 9129->9171 9130->9117 9132 9ad52b __freea 14 API calls 9132->9117 9133->9129 9134->9132 9136 9ae179 CallCatchBlock 9135->9136 9143 9ae193 9136->9143 9179 9ad642 EnterCriticalSection 9136->9179 9139 9acd36 CallUnexpected 41 API calls 9144 9ae20c 9139->9144 9140 9ae042 9146 9add98 9140->9146 9141 9ae1a3 9142 9ae1cf 9141->9142 9145 9ad52b __freea 14 API calls 9141->9145 9180 9ae1ec 9142->9180 9143->9139 9143->9140 9145->9142 9184 9adb29 9146->9184 9149 9addcb 9151 9adde2 9149->9151 9152 9addd0 GetACP 9149->9152 9150 9addb9 GetOEMCP 9150->9151 9151->9117 9153 9afac8 9151->9153 9152->9151 9154 9afb06 9153->9154 9155 9afad6 _unexpected 9153->9155 9157 9abaf8 ___std_exception_copy 14 API calls 9154->9157 9155->9154 9156 9afaf1 HeapAlloc 9155->9156 9159 9aed5b _unexpected 2 API calls 9155->9159 9156->9155 9158 9afb04 9156->9158 9157->9158 9158->9119 9159->9155 9161 9add98 43 API calls 9160->9161 9162 9ae288 9161->9162 9164 9ae2c5 IsValidCodePage 9162->9164 9168 9ae301 CallUnexpected 9162->9168 9163 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9165 9ae0af 9163->9165 9166 9ae2d7 9164->9166 9164->9168 9165->9125 9165->9126 9167 9ae306 GetCPInfo 9166->9167 9170 9ae2e0 CallUnexpected 9166->9170 9167->9168 9167->9170 9168->9163 9223 9ade6c 9170->9223 9172 9adc96 CallCatchBlock 9171->9172 9307 9ad642 EnterCriticalSection 9172->9307 9174 9adca0 9308 9adcd7 9174->9308 9179->9141 9183 9ad68a LeaveCriticalSection 9180->9183 9182 9ae1f3 9182->9143 9183->9182 9185 9adb40 9184->9185 9186 9adb47 9184->9186 9185->9149 9185->9150 9186->9185 9187 9ad240 _unexpected 41 API calls 9186->9187 9188 9adb68 9187->9188 9192 9b046d 9188->9192 9193 9b0480 9192->9193 9194 9adb7e 9192->9194 9193->9194 9200 9aff56 9193->9200 9196 9b04cb 9194->9196 9197 9b04de 9196->9197 9198 9b04f3 9196->9198 9197->9198 9218 9ae255 9197->9218 9198->9185 9201 9aff62 CallCatchBlock 9200->9201 9202 9ad240 _unexpected 41 API calls 9201->9202 9203 9aff6b 9202->9203 9204 9affb1 9203->9204 9213 9ad642 EnterCriticalSection 9203->9213 9204->9194 9206 9aff89 9207 9affd7 ___scrt_uninitialize_crt 14 API calls 9206->9207 9208 9aff9a 9207->9208 9214 9affb6 9208->9214 9211 9acd36 CallUnexpected 41 API calls 9212 9affd6 9211->9212 9213->9206 9217 9ad68a LeaveCriticalSection 9214->9217 9216 9affad 9216->9204 9216->9211 9217->9216 9219 9ad240 _unexpected 41 API calls 9218->9219 9220 9ae25a 9219->9220 9221 9ae16d ___scrt_uninitialize_crt 41 API calls 9220->9221 9222 9ae265 9221->9222 9222->9198 9224 9ade94 GetCPInfo 9223->9224 9233 9adf5d 9223->9233 9230 9adeac 9224->9230 9224->9233 9226 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9228 9ae016 9226->9228 9228->9168 9234 9afb64 9230->9234 9232 9b0dae 45 API calls 9232->9233 9233->9226 9235 9adb29 41 API calls 9234->9235 9236 9afb84 9235->9236 9254 9ae50a 9236->9254 9238 9afc48 9241 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9238->9241 9239 9afc40 9257 9afc6d 9239->9257 9240 9afbb1 9240->9238 9240->9239 9243 9afac8 15 API calls 9240->9243 9245 9afbd6 CallUnexpected __alloca_probe_16 9240->9245 9244 9adf14 9241->9244 9243->9245 9249 9b0dae 9244->9249 9245->9239 9246 9ae50a ___scrt_uninitialize_crt MultiByteToWideChar 9245->9246 9247 9afc21 9246->9247 9247->9239 9248 9afc2c GetStringTypeW 9247->9248 9248->9239 9250 9adb29 41 API calls 9249->9250 9251 9b0dc1 9250->9251 9261 9b0bc0 9251->9261 9255 9ae51b MultiByteToWideChar 9254->9255 9255->9240 9258 9afc8a 9257->9258 9259 9afc79 9257->9259 9258->9238 9259->9258 9260 9ad52b __freea 14 API calls 9259->9260 9260->9258 9262 9b0bdb 9261->9262 9263 9ae50a ___scrt_uninitialize_crt MultiByteToWideChar 9262->9263 9267 9b0c21 9263->9267 9264 9b0d99 9265 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9264->9265 9266 9adf35 9265->9266 9266->9232 9267->9264 9268 9afac8 15 API calls 9267->9268 9270 9b0c47 __alloca_probe_16 9267->9270 9277 9b0ccd 9267->9277 9268->9270 9269 9afc6d __freea 14 API calls 9269->9264 9271 9ae50a ___scrt_uninitialize_crt MultiByteToWideChar 9270->9271 9270->9277 9272 9b0c8c 9271->9272 9272->9277 9289 9ae9ce 9272->9289 9275 9b0cbe 9275->9277 9281 9ae9ce 6 API calls 9275->9281 9276 9b0cf6 9278 9b0d81 9276->9278 9279 9afac8 15 API calls 9276->9279 9282 9b0d08 __alloca_probe_16 9276->9282 9277->9269 9280 9afc6d __freea 14 API calls 9278->9280 9279->9282 9280->9277 9281->9277 9282->9278 9283 9ae9ce 6 API calls 9282->9283 9284 9b0d4b 9283->9284 9284->9278 9295 9ae586 9284->9295 9286 9b0d65 9286->9278 9287 9b0d6e 9286->9287 9288 9afc6d __freea 14 API calls 9287->9288 9288->9277 9298 9ae6c2 9289->9298 9293 9aea1f LCMapStringW 9294 9ae9df 9293->9294 9294->9275 9294->9276 9294->9277 9296 9ae59d WideCharToMultiByte 9295->9296 9296->9286 9299 9ae7c1 _unexpected 5 API calls 9298->9299 9300 9ae6d8 9299->9300 9300->9294 9301 9aea2b 9300->9301 9304 9ae6dc 9301->9304 9303 9aea36 9303->9293 9305 9ae7c1 _unexpected 5 API calls 9304->9305 9306 9ae6f2 9305->9306 9306->9303 9307->9174 9318 9ae470 9308->9318 9310 9adcf9 9311 9ae470 41 API calls 9310->9311 9312 9add18 9311->9312 9313 9ad52b __freea 14 API calls 9312->9313 9314 9adcad 9312->9314 9313->9314 9315 9adccb 9314->9315 9332 9ad68a LeaveCriticalSection 9315->9332 9317 9adcb9 9317->9134 9319 9ae481 9318->9319 9328 9ae47d __InternalCxxFrameHandler 9318->9328 9320 9ae488 9319->9320 9322 9ae49b CallUnexpected 9319->9322 9321 9abaf8 ___std_exception_copy 14 API calls 9320->9321 9323 9ae48d 9321->9323 9325 9ae4c9 9322->9325 9326 9ae4d2 9322->9326 9322->9328 9324 9aba3a ___std_exception_copy 41 API calls 9323->9324 9324->9328 9327 9abaf8 ___std_exception_copy 14 API calls 9325->9327 9326->9328 9330 9abaf8 ___std_exception_copy 14 API calls 9326->9330 9329 9ae4ce 9327->9329 9328->9310 9331 9aba3a ___std_exception_copy 41 API calls 9329->9331 9330->9329 9331->9328 9332->9317 9801 9ad975 9808 9adbf8 9801->9808 9804 9ad98b 9806 9ad52b __freea 14 API calls 9804->9806 9805 9ad52b __freea 14 API calls 9805->9804 9807 9ad930 9806->9807 9809 9adc0a 9808->9809 9816 9ad97f 9808->9816 9810 9adc0f 9809->9810 9811 9adc35 9809->9811 9812 9ad6d2 _unexpected 14 API calls 9810->9812 9814 9abb26 44 API calls 9811->9814 9811->9816 9813 9adc18 9812->9813 9815 9ad52b __freea 14 API calls 9813->9815 9817 9adc55 9814->9817 9815->9816 9816->9804 9816->9805 9818 9ad52b __freea 14 API calls 9817->9818 9818->9816 9819 9ac96a 9820 9a9759 ___scrt_uninitialize_crt 7 API calls 9819->9820 9821 9ac971 9820->9821 9822 9a996e 9825 9a99bc 9822->9825 9826 9a9979 9825->9826 9827 9a99c5 9825->9827 9827->9826 9828 9a9b24 CallUnexpected 51 API calls 9827->9828 9829 9a9a00 9828->9829 9830 9a9b24 CallUnexpected 51 API calls 9829->9830 9831 9a9a0b 9830->9831 9832 9acc9b _unexpected 41 API calls 9831->9832 9833 9a9a13 9832->9833 9834 9aad6f 9835 9ab2b7 ___std_exception_destroy 14 API calls 9834->9835 9836 9aad84 _AnonymousOriginator 9835->9836 9333 9a65e2 9334 9a65f5 9333->9334 9336 9a65ec 9333->9336 9335 9a6605 HeapReAlloc 9334->9335 9334->9336 9335->9336 9337 9aa3e3 9338 9aabde __InternalCxxFrameHandler 54 API calls 9337->9338 9339 9aa409 9338->9339 9340 9aace0 9343 9aad13 9340->9343 9346 9ab254 9343->9346 9347 9ab261 ___std_exception_copy 9346->9347 9351 9aacee 9346->9351 9348 9ab28e 9347->9348 9347->9351 9352 9acd85 9347->9352 9350 9abb0b ___std_exception_destroy 14 API calls 9348->9350 9350->9351 9353 9acd93 9352->9353 9354 9acda1 9352->9354 9353->9354 9356 9acdb9 9353->9356 9355 9abaf8 ___std_exception_copy 14 API calls 9354->9355 9360 9acda9 9355->9360 9358 9acdb3 9356->9358 9359 9abaf8 ___std_exception_copy 14 API calls 9356->9359 9357 9aba3a ___std_exception_copy 41 API calls 9357->9358 9358->9348 9359->9360 9360->9357 9361 9b20e1 9362 9b2101 9361->9362 9365 9b2138 9362->9365 9364 9b212b 9367 9b213f 9365->9367 9366 9b21a0 9370 9b31ce 9366->9370 9374 9b32d7 9366->9374 9367->9366 9368 9b215f 9367->9368 9368->9370 9372 9b32d7 20 API calls 9368->9372 9370->9364 9373 9b31fe 9372->9373 9373->9364 9375 9b32e0 9374->9375 9378 9b374f 9375->9378 9379 9b378e __startOneArgErrorHandling 9378->9379 9383 9b3810 __startOneArgErrorHandling 9379->9383 9386 9b3be8 9379->9386 9381 9b3f01 __startOneArgErrorHandling 14 API calls 9382 9b3845 9381->9382 9384 9a73ee __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 9382->9384 9383->9381 9383->9382 9385 9b21ee 9384->9385 9385->9364 9387 9b3c0b __raise_exc RaiseException 9386->9387 9388 9b3c06 9387->9388 9388->9383 9837 9af466 9838 9af395 ___scrt_uninitialize_crt 70 API calls 9837->9838 9839 9af46e 9838->9839 9847 9b1a57 9839->9847 9841 9af473 9857 9b1b02 9841->9857 9844 9af49d 9845 9ad52b __freea 14 API calls 9844->9845 9846 9af4a8 9845->9846 9848 9b1a63 CallCatchBlock 9847->9848 9861 9ad642 EnterCriticalSection 9848->9861 9850 9b1ada 9868 9b1af9 9850->9868 9851 9b1a6e 9851->9850 9853 9b1aae DeleteCriticalSection 9851->9853 9862 9b20a3 9851->9862 9856 9ad52b __freea 14 API calls 9853->9856 9856->9851 9858 9b1b19 9857->9858 9860 9af482 DeleteCriticalSection 9857->9860 9859 9ad52b __freea 14 API calls 9858->9859 9858->9860 9859->9860 9860->9841 9860->9844 9861->9851 9863 9b20b6 ___std_exception_copy 9862->9863 9871 9b1f7e 9863->9871 9865 9b20c2 9866 9ab776 ___std_exception_copy 41 API calls 9865->9866 9867 9b20ce 9866->9867 9867->9851 9943 9ad68a LeaveCriticalSection 9868->9943 9870 9b1ae6 9870->9841 9872 9b1f8a CallCatchBlock 9871->9872 9873 9b1fb7 9872->9873 9874 9b1f94 9872->9874 9876 9b1faf 9873->9876 9882 9af4b2 EnterCriticalSection 9873->9882 9875 9ab9bd ___std_exception_copy 41 API calls 9874->9875 9875->9876 9876->9865 9878 9b1fd5 9883 9b2015 9878->9883 9880 9b1fe2 9897 9b200d 9880->9897 9882->9878 9884 9b2022 9883->9884 9885 9b2045 9883->9885 9886 9ab9bd ___std_exception_copy 41 API calls 9884->9886 9887 9af2c7 ___scrt_uninitialize_crt 66 API calls 9885->9887 9896 9b203d 9885->9896 9886->9896 9888 9b205d 9887->9888 9889 9b1b02 14 API calls 9888->9889 9890 9b2065 9889->9890 9891 9b065c ___scrt_uninitialize_crt 41 API calls 9890->9891 9892 9b2071 9891->9892 9900 9b289c 9892->9900 9895 9ad52b __freea 14 API calls 9895->9896 9896->9880 9942 9af4c6 LeaveCriticalSection 9897->9942 9899 9b2013 9899->9876 9901 9b28c5 9900->9901 9906 9b2078 9900->9906 9902 9b2914 9901->9902 9904 9b28ec 9901->9904 9903 9ab9bd ___std_exception_copy 41 API calls 9902->9903 9903->9906 9907 9b280b 9904->9907 9906->9895 9906->9896 9908 9b2817 CallCatchBlock 9907->9908 9915 9af701 EnterCriticalSection 9908->9915 9910 9b2825 9913 9b2856 9910->9913 9916 9b293f 9910->9916 9929 9b2890 9913->9929 9915->9910 9917 9af7d8 ___scrt_uninitialize_crt 41 API calls 9916->9917 9919 9b294f 9917->9919 9918 9b2955 9932 9af747 9918->9932 9919->9918 9920 9b2987 9919->9920 9922 9af7d8 ___scrt_uninitialize_crt 41 API calls 9919->9922 9920->9918 9923 9af7d8 ___scrt_uninitialize_crt 41 API calls 9920->9923 9924 9b297e 9922->9924 9925 9b2993 CloseHandle 9923->9925 9926 9af7d8 ___scrt_uninitialize_crt 41 API calls 9924->9926 9925->9918 9927 9b299f GetLastError 9925->9927 9926->9920 9927->9918 9928 9b29ad ___scrt_uninitialize_crt 9928->9913 9941 9af724 LeaveCriticalSection 9929->9941 9931 9b2879 9931->9906 9933 9af7bd 9932->9933 9934 9af756 9932->9934 9935 9abaf8 ___std_exception_copy 14 API calls 9933->9935 9934->9933 9940 9af780 9934->9940 9936 9af7c2 9935->9936 9937 9abae5 ___scrt_uninitialize_crt 14 API calls 9936->9937 9938 9af7ad 9937->9938 9938->9928 9939 9af7a7 SetStdHandle 9939->9938 9940->9938 9940->9939 9941->9931 9942->9899 9943->9870 9389 9aa5e7 9390 9acd36 CallUnexpected 41 API calls 9389->9390 9391 9aa5ef 9390->9391 9392 9ad4e5 9400 9ae884 9392->9400 9395 9ad391 ___std_exception_copy 14 API calls 9396 9ad501 9395->9396 9397 9ad50e 9396->9397 9405 9ad511 9396->9405 9399 9ad4f9 9401 9ae7c1 _unexpected 5 API calls 9400->9401 9402 9ae8a0 9401->9402 9403 9ae8b8 TlsAlloc 9402->9403 9404 9ad4ef 9402->9404 9403->9404 9404->9395 9404->9399 9406 9ad51b 9405->9406 9407 9ad521 9405->9407 9409 9ae8c3 9406->9409 9407->9399 9410 9ae7c1 _unexpected 5 API calls 9409->9410 9411 9ae8df 9410->9411 9412 9ae8fa TlsFree 9411->9412 9413 9ae8e8 9411->9413 9413->9407

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 009A6C1E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 009A6C2C
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 009A6C33
                                                                                                                                                                                                      • LoadLibraryExW.KERNELBASE(?,00000000,00000000), ref: 009A6C72
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 009A6C8D
                                                                                                                                                                                                      • GetCommandLineW.KERNEL32(?), ref: 009A6C9C
                                                                                                                                                                                                      • FreeLibrary.KERNELBASE(00000000), ref: 009A6CAF
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                                                                                                                                      • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                                      • API String ID: 1042781669-3472957018
                                                                                                                                                                                                      • Opcode ID: 41cd9c17bdadad26ffa57ae05844ad4218f2b38ecf288a9d8b7d704bb857a56d
                                                                                                                                                                                                      • Instruction ID: f666be23dbd98be46f86c8e51c97e26b3e54a0956cc0b882a4633fab1328763a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 41cd9c17bdadad26ffa57ae05844ad4218f2b38ecf288a9d8b7d704bb857a56d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7111E932644215BBC711BBE49D49B6EB778DFC2774B190215FA82B7290DA248D0067E0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A6A8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 009A6AE1
                                                                                                                                                                                                      • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 009A6AFC
                                                                                                                                                                                                      • PathAppendW.SHLWAPI(?,goopdate.dll,?,?,00000104), ref: 009A6B2B
                                                                                                                                                                                                        • Part of subcall function 009A6820: GetLastError.KERNEL32(009A6AF0,?,?,00000104), ref: 009A6820
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                                                                                                                                      • String ID: goopdate.dll
                                                                                                                                                                                                      • API String ID: 3739599460-235033069
                                                                                                                                                                                                      • Opcode ID: c68a14f7bebba401f465298d11a0c8d8e46341a9ccc451eb30f44614b8b2470e
                                                                                                                                                                                                      • Instruction ID: deee3d5dbc60b9d2bd5436746a8a08633a3434b4b4c11668aaaed61c95733319
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c68a14f7bebba401f465298d11a0c8d8e46341a9ccc451eb30f44614b8b2470e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 154184F190521C96CF20EB64DC45FDAB3BC9F86314F1486E5A645E3142EA349E858AE0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009AE6F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 67 9ae6f6-9ae702 68 9ae794-9ae797 67->68 69 9ae79d 68->69 70 9ae707-9ae718 68->70 71 9ae79f-9ae7a3 69->71 72 9ae71a-9ae71d 70->72 73 9ae725-9ae73e LoadLibraryExW 70->73 74 9ae7bd-9ae7bf 72->74 75 9ae723 72->75 76 9ae740-9ae749 GetLastError 73->76 77 9ae7a4-9ae7b4 73->77 74->71 79 9ae791 75->79 80 9ae74b-9ae75d call 9acec8 76->80 81 9ae782-9ae78f 76->81 77->74 78 9ae7b6-9ae7b7 FreeLibrary 77->78 78->74 79->68 80->81 84 9ae75f-9ae771 call 9acec8 80->84 81->79 84->81 87 9ae773-9ae780 LoadLibraryExW 84->87 87->77 87->81
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,009AE803,009AC8BB,0000000C,?,00000000,00000000,?,009AE95D,00000021,FlsSetValue,009A2924,009A292C,?), ref: 009AE7B7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-537541572
                                                                                                                                                                                                      • Opcode ID: 32dc1ca58938b1717a6a9213eb6f39ea04460a2461c7fb0216e1ac927e60b7e3
                                                                                                                                                                                                      • Instruction ID: d6ffb4328d3910103fd3362402909e4a5230dee7568cdda0021f46f913a4686f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32dc1ca58938b1717a6a9213eb6f39ea04460a2461c7fb0216e1ac927e60b7e3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 60212932A09221ABCB219B68DD84A5A776CEF93770F250320FD16A72D0E734ED00DAD0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A69EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 88 9a69ee-9a6a1d RegOpenKeyExW 89 9a6a2b-9a6a63 call 9a6dfe SHQueryValueExW call 9a6d16 88->89 90 9a6a1f 88->90 96 9a6a68-9a6a6a 89->96 91 9a6a88-9a6a8b 90->91 92 9a6a21-9a6a29 90->92 92->91 97 9a6a7b-9a6a83 96->97 98 9a6a6c 96->98 97->91 99 9a6a6e-9a6a71 98->99 100 9a6a77-9a6a79 98->100 99->100 100->91
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegOpenKeyExW.KERNELBASE(?,Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019},00000000,00020019,?,?,?), ref: 009A6A15
                                                                                                                                                                                                      • SHQueryValueExW.SHLWAPI(?,009A5D10,00000000,?,00000000,?,00000032,?,?), ref: 009A6A58
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}, xrefs: 009A6A07
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: OpenQueryValue
                                                                                                                                                                                                      • String ID: Software\BraveSoftware\Update\Clients\{B131C935-9BE6-41DA-9599-1F776BEB8019}
                                                                                                                                                                                                      • API String ID: 4153817207-790910960
                                                                                                                                                                                                      • Opcode ID: 3e20faa175ed04791637b6a3fade771a52de23a44db1c916bbc9b023fab7df55
                                                                                                                                                                                                      • Instruction ID: 34095bea388b7e757c972b9d06f3cea984333148563651821c303a90898da8cb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3e20faa175ed04791637b6a3fade771a52de23a44db1c916bbc9b023fab7df55
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 42115A76D40119ABDB109FA98D05EBFBBBCEB82720F544255F815F61D1D6748E00D7E0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009ABEC7 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,?,009ABEC1,?,009AB83D,?,?,518CF630,009AB83D,?), ref: 009ABED8
                                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000,?,009ABEC1,?,009AB83D,?,?,518CF630,009AB83D,?), ref: 009ABEDF
                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 009ABEF1
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                      • Opcode ID: 7fb9607c92c0aeda527a5cac84d731f7cc337d14d0b4179ec69072c36a2164a1
                                                                                                                                                                                                      • Instruction ID: 297528a1be2630ad0c17d4f312216d6e62f6335dc1625e987ecf19119a5e8ad8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7fb9607c92c0aeda527a5cac84d731f7cc337d14d0b4179ec69072c36a2164a1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18D09232018148BFCF013FA1EE0DA997F2ABF85361B144616BA194A132DB319A52AAD1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A6887 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 009A68B9
                                                                                                                                                                                                      • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 009A697C
                                                                                                                                                                                                        • Part of subcall function 009A6F7D: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,009A6912,-00000010), ref: 009A6FAE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFindFolderModuleNamePathResource
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2248019921-0
                                                                                                                                                                                                      • Opcode ID: 1da05f4f32937a917202c7c9764726337c849dab0492f863dc3c3d0fa94c5b21
                                                                                                                                                                                                      • Instruction ID: 12835db9bf2deb7ebc49a457a1820ba2b096b35efc68ccdd8f6ca515c7e270b2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1da05f4f32937a917202c7c9764726337c849dab0492f863dc3c3d0fa94c5b21
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C416D71D01119AFCB04EBA8CD95AFEB779EFC2740B584569A912A72C1EB305E05CBD0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009AE7C1 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 167 9ae7c1-9ae7e9 168 9ae7eb-9ae7ed 167->168 169 9ae7ef-9ae7f1 167->169 170 9ae840-9ae843 168->170 171 9ae7f3-9ae7f5 169->171 172 9ae7f7-9ae7fe call 9ae6f6 169->172 171->170 174 9ae803-9ae807 172->174 175 9ae809-9ae817 GetProcAddress 174->175 176 9ae826-9ae83d 174->176 175->176 177 9ae819-9ae824 call 9abd26 175->177 178 9ae83f 176->178 177->178 178->170
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 3fac7491e1e9e34d03b20e2352a356e42ead361c40389d65f0318840e0107e20
                                                                                                                                                                                                      • Instruction ID: 0774ae1e10f74bcd41db4aa10765015571358390f3531b57def683e67eebbb64
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3fac7491e1e9e34d03b20e2352a356e42ead361c40389d65f0318840e0107e20
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 67014C337146259FDB26DE6DEC40A5F339AFBC6770B198621F904CB184DA34D80197D0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 009AD9B3 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 009ADA4E
                                                                                                                                                                                                      • FindNextFileW.KERNEL32(00000000,?), ref: 009ADAC9
                                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 009ADAEB
                                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 009ADB0E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1164774033-0
                                                                                                                                                                                                      • Opcode ID: 6169d956027f342e027a99587dbc11dd26b6cb094ce20161d1508aa17c82c759
                                                                                                                                                                                                      • Instruction ID: f3fddc2a7ff2d561c2017c740479fe3d4bcc9850cde970bf306c0588a6b47772
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6169d956027f342e027a99587dbc11dd26b6cb094ce20161d1508aa17c82c759
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A341DA71A0A519AFDB20EFA8CD88EBAB37CEF86314F144195E407D7544E7349E80CBA4
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A7BB0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009A7BBC
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 009A7C88
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009A7CA8
                                                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(?), ref: 009A7CB2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 254469556-0
                                                                                                                                                                                                      • Opcode ID: fb8e0510d32a828eed5c3aaf5086a1a60aecc9bde12899d3a6b459a5e8c5ce1b
                                                                                                                                                                                                      • Instruction ID: d4b01ca6573dcd61eda7770a976f020348db3aa44480aa630d9bd9de96f43feb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fb8e0510d32a828eed5c3aaf5086a1a60aecc9bde12899d3a6b459a5e8c5ce1b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C8312975D092189BDB11EFA0DD8A7CDBBB8AF48300F10419AE40CA7290EB715A849F44
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A7423 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 288 9a7423-9a7444 InitializeCriticalSectionAndSpinCount GetModuleHandleW 289 9a7446-9a7455 GetModuleHandleW 288->289 290 9a7457-9a7473 GetProcAddress * 2 288->290 289->290 291 9a749d-9a74b7 call 9a7bb0 DeleteCriticalSection 289->291 292 9a7487-9a749b CreateEventW 290->292 293 9a7475-9a7477 290->293 298 9a74b9-9a74ba CloseHandle 291->298 299 9a74c0 291->299 292->291 294 9a7484-9a7486 292->294 293->292 296 9a7479-9a747f 293->296 296->294 298->299
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • InitializeCriticalSectionAndSpinCount.KERNEL32(009B592C,00000FA0,?,?,009A7401), ref: 009A742F
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,009A7401), ref: 009A743A
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,009A7401), ref: 009A744B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 009A745D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 009A746B
                                                                                                                                                                                                      • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,009A7401), ref: 009A748E
                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(009B592C,00000007,?,?,009A7401), ref: 009A74AA
                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,009A7401), ref: 009A74BA
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • WakeAllConditionVariable, xrefs: 009A7463
                                                                                                                                                                                                      • SleepConditionVariableCS, xrefs: 009A7457
                                                                                                                                                                                                      • kernel32.dll, xrefs: 009A7446
                                                                                                                                                                                                      • api-ms-win-core-synch-l1-2-0.dll, xrefs: 009A7435
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                                      • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                                      • API String ID: 2565136772-3242537097
                                                                                                                                                                                                      • Opcode ID: ee05e08cf5363325f769faec62f602e2bf888933761f26aa5f2e847bd6535852
                                                                                                                                                                                                      • Instruction ID: 0394a7e556a913cbb6c82c4bc53ace344607439b8be56bdf98c2c040e7cae654
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee05e08cf5363325f769faec62f602e2bf888933761f26aa5f2e847bd6535852
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2801B57065D710ABD7212BF56E0EB6ABBAC9BC6770B010316F904D21A0DA60CC00A6E0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009AA670 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 009AA76D
                                                                                                                                                                                                      • type_info::operator==.LIBVCRUNTIME ref: 009AA78F
                                                                                                                                                                                                      • ___TypeMatch.LIBVCRUNTIME ref: 009AA89E
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 009AA970
                                                                                                                                                                                                      • _UnwindNestedFrames.LIBCMT ref: 009AA9F4
                                                                                                                                                                                                      • CallUnexpected.LIBVCRUNTIME ref: 009AAA0F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 2123188842-393685449
                                                                                                                                                                                                      • Opcode ID: f62fe0b37cdc9ba1628473c108c74c00d7f578cbc9c61364ca37ae82a8c4c4f8
                                                                                                                                                                                                      • Instruction ID: 17ce75c55f534daedd1bc57cb7f19f137b4d34f97dfe7612660efc115e688143
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f62fe0b37cdc9ba1628473c108c74c00d7f578cbc9c61364ca37ae82a8c4c4f8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 32B18C75C00209EFCF25DFA8D981AAEB7B9FF86310B15405AE8116B212D335DA51CFE2
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A97B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 009A97E7
                                                                                                                                                                                                      • ___except_validate_context_record.LIBVCRUNTIME ref: 009A97EF
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 009A9878
                                                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 009A98A3
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 009A98F8
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 1170836740-1018135373
                                                                                                                                                                                                      • Opcode ID: 99fe017f703eaf91b7a5b145c131ec53ed204cea7a8308a48507f8e5af0d17ac
                                                                                                                                                                                                      • Instruction ID: 88a7ce5981b1a44df432622c90bd8f66d50d5987c29794f4e119db280d03af08
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 99fe017f703eaf91b7a5b145c131ec53ed204cea7a8308a48507f8e5af0d17ac
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2419234A002099BCF10EF6CC884B9EBBB5BF87324F148155E8159B392D7359A55CFD0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A9B32 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,009A9B29,009A9ABA,009A7D97), ref: 009A9B40
                                                                                                                                                                                                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009A9B4E
                                                                                                                                                                                                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009A9B67
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,009A9B29,009A9ABA,009A7D97), ref: 009A9BB9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3852720340-0
                                                                                                                                                                                                      • Opcode ID: 1242b6c81aa49c60022f3d7852f4e228184a6233f9efa10b1d84c2a814b636a0
                                                                                                                                                                                                      • Instruction ID: a5cc0e0c0f676698df5de189efc697b621edcc833da119607ff7425c008d27b5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1242b6c81aa49c60022f3d7852f4e228184a6233f9efa10b1d84c2a814b636a0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E01F23222E7116EEB2637B47C99B673A68FB97BB5720033AF515940E0EF124C01A1E0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A9E17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,?,009A9ED8,?,?,009B5CEC,00000000,?,009AA003,00000004,InitializeCriticalSectionEx,009A1C14,InitializeCriticalSectionEx,00000000), ref: 009A9EA7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-2084034818
                                                                                                                                                                                                      • Opcode ID: 9edd1f592c98808c8c2efedbfc02e6dc0f756b537faf62955f97411ff655d86e
                                                                                                                                                                                                      • Instruction ID: 1c940a309a653e436258cb13a0ff936d7eb8f07189227a7c21b3f378635f87cf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9edd1f592c98808c8c2efedbfc02e6dc0f756b537faf62955f97411ff655d86e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 68117332A49625ABDF22DBA89C45B5EB398BF43770F350711E901EB291D770ED009AD1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009ABF1A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,518CF630,?,?,00000000,009B44E2,000000FF,?,009ABEED,?,?,009ABEC1,?), ref: 009ABF4F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009ABF61
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,00000000,009B44E2,000000FF,?,009ABEED,?,?,009ABEC1,?), ref: 009ABF83
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                      • Opcode ID: 4c5250ac7e31a1451ecc9528d06a44122d78ef8aa342ebf78ebd86c40eaf3ce9
                                                                                                                                                                                                      • Instruction ID: 591fb29df270df418634213d90708f46d108c483922dc3561614614f9ad3eaf1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c5250ac7e31a1451ecc9528d06a44122d78ef8aa342ebf78ebd86c40eaf3ce9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D01A731518616EFDB119F90CD05BAEF7BCFB45B25F044726F811A22D0D7749800CAD0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009B0BC0 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 009B0C47
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 009B0D08
                                                                                                                                                                                                      • __freea.LIBCMT ref: 009B0D6F
                                                                                                                                                                                                        • Part of subcall function 009AFAC8: HeapAlloc.KERNEL32(00000000,00000000,009AC8BB,?,009AD5AD,?,00000000,?,009ABB6F,00000000,009AC8BB,00000004,?,00000000,?,009AC6B5), ref: 009AFAFA
                                                                                                                                                                                                      • __freea.LIBCMT ref: 009B0D84
                                                                                                                                                                                                      • __freea.LIBCMT ref: 009B0D94
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1096550386-0
                                                                                                                                                                                                      • Opcode ID: 90c1a40507eb8f2c75fca9c4fb9b90a0540c4bb23d5e057f78a3f9e1ab56d04c
                                                                                                                                                                                                      • Instruction ID: a53097de36fe506b7f2b612abbdccd215d8baf82e66ba2fecb1a6e78e4a8c082
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 90c1a40507eb8f2c75fca9c4fb9b90a0540c4bb23d5e057f78a3f9e1ab56d04c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F451927260020AAFDF209FA4DE81EFF7AADEBC5760B150629FC08D6191E770DC1097A0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009B0FA1 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetConsoleOutputCP.KERNEL32(518CF630,?,00000000,?), ref: 009B1004
                                                                                                                                                                                                        • Part of subcall function 009AE586: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,009B0D65,?,00000000,-00000008), ref: 009AE632
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009B125F
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009B12A7
                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 009B134A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2112829910-0
                                                                                                                                                                                                      • Opcode ID: b92ab386426a5796ce733a2fb6b70252111c28edea1cbb6f6e95f5598d0a57ab
                                                                                                                                                                                                      • Instruction ID: bb1a963235eb3fd02d265c05b702eb31376b200a25ae76842a76e72088ab7116
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b92ab386426a5796ce733a2fb6b70252111c28edea1cbb6f6e95f5598d0a57ab
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 19D15875D042489FCB15CFE8D990AEDBBF8FF49320F58462AE865EB251E730A941CB50
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009AA419 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AdjustPointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1740715915-0
                                                                                                                                                                                                      • Opcode ID: 74c2720d385998cd67b9bb8150f610e5953f5904d4aab04a58c1088d99acf8c0
                                                                                                                                                                                                      • Instruction ID: cb08a107fadf81196d6282717d203f70e6d785699ff90afcbb225583e4b62951
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 74c2720d385998cd67b9bb8150f610e5953f5904d4aab04a58c1088d99acf8c0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0551ED72E04202AFDB299F54D845BAEB7A8FF86314F14452DF806872A1E771EC40CBD6
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009B27B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,009B1F6A,?,00000001,?,?,?,009B139E,?,?,00000000), ref: 009B27CD
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,009B1F6A,?,00000001,?,?,?,009B139E,?,?,00000000,?,?,?,009B1925,?), ref: 009B27D9
                                                                                                                                                                                                        • Part of subcall function 009B279F: CloseHandle.KERNEL32(FFFFFFFE,009B27E9,?,009B1F6A,?,00000001,?,?,?,009B139E,?,?,00000000,?,?), ref: 009B27AF
                                                                                                                                                                                                      • ___initconout.LIBCMT ref: 009B27E9
                                                                                                                                                                                                        • Part of subcall function 009B2761: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009B2790,009B1F57,?,?,009B139E,?,?,00000000,?), ref: 009B2774
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,009B1F6A,?,00000001,?,?,?,009B139E,?,?,00000000,?), ref: 009B27FE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2744216297-0
                                                                                                                                                                                                      • Opcode ID: dc9c70f701524970b4f71d7fddaa020883065ab06eb2ca049c164ddac4016a12
                                                                                                                                                                                                      • Instruction ID: 9b8bad70dfd3a4a87ebe500aada1412045565201e5545140ea032c9a0dc24d24
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dc9c70f701524970b4f71d7fddaa020883065ab06eb2ca049c164ddac4016a12
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 86F03036419124BBCF222FD5DE08ADA7F66FB487B0F014210FE1895130CA32C820EBE0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A7593 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SleepConditionVariableCS.KERNELBASE(?,009A7530,00000064), ref: 009A75B6
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(009B592C,?,?,009A7530,00000064,?,009A6688,009B64A0,?,?,009A6DDF,?,009A6898), ref: 009A75C0
                                                                                                                                                                                                      • WaitForSingleObjectEx.KERNEL32(?,00000000,?,009A7530,00000064,?,009A6688,009B64A0,?,?,009A6DDF,?,009A6898), ref: 009A75D1
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(009B592C,?,009A7530,00000064,?,009A6688,009B64A0,?,?,009A6DDF,?,009A6898), ref: 009A75D8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3269011525-0
                                                                                                                                                                                                      • Opcode ID: b747ff2ac24b955117c7c5c36456660f8ed9dae22db9bc4b95437f4649da908e
                                                                                                                                                                                                      • Instruction ID: bf65bb60a120a389a487097370a2807a5b37554af916dde4664fd22c367ce47d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b747ff2ac24b955117c7c5c36456660f8ed9dae22db9bc4b95437f4649da908e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24E0923291DA28FBCB153FD0EE09BAEBF29EB89731B810211F9095616086624800EBD0
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009AAA1A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 009AAA3F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EncodePointer
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 2118026453-2084237596
                                                                                                                                                                                                      • Opcode ID: 4aba2cd7564f15c8150ae48dafccc14684c7287c91e2794ad4ac6323a9e04716
                                                                                                                                                                                                      • Instruction ID: 0728630a2cbe25a9488d56449f6a74830f0f35a766d248c660ecd88784ed12a3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4aba2cd7564f15c8150ae48dafccc14684c7287c91e2794ad4ac6323a9e04716
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24416A71900209AFCF16DF98CD81AEEBBBAFF49304F198159F904A7261D3359950DBA2
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 009A72D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 009A6511: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 009A6516
                                                                                                                                                                                                        • Part of subcall function 009A6511: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 009A6520
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32(?,?,?,009A648A), ref: 009A7309
                                                                                                                                                                                                      • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009A648A), ref: 009A7318
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009A7313
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000002.00000002.1760496403.00000000009A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 009A0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760438168.00000000009A0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760522952.00000000009B5000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000002.00000002.1760541852.00000000009B7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_9a0000_BraveUpdate.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                                      • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                      • API String ID: 450123788-631824599
                                                                                                                                                                                                      • Opcode ID: 2e6e090a41db1aaff6d1d14f4ef8ab35166856cee0ee98a98105602bff739468
                                                                                                                                                                                                      • Instruction ID: 276ece5f12f1dee273999059cdfdcf486fe4f7bb1525c04de22fd01fb768544c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e6e090a41db1aaff6d1d14f4ef8ab35166856cee0ee98a98105602bff739468
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BCE092706197508BC770AFB4FE05302BBE8AF42754F004A5DE896C2241DBB4E444DBD1
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00007FF65A3344A8 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 152registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: PrivateProfile$CloseOpenQueryValue
                                                                                                                                                                                                      • String ID: AppendToFile$EnableLogging$IsEnabledLogToFile$LogToOutputDebug$LoggingLevel$LoggingSettings$ShowTime$Software\BraveSoftware\UpdateDev\
                                                                                                                                                                                                      • API String ID: 2210674228-3529394150
                                                                                                                                                                                                      • Opcode ID: c67d0b199afa614a42569769cdc2344d9aa1607615deae8bbc4545d499da46ac
                                                                                                                                                                                                      • Instruction ID: 986af780547e656477932946972f5734d309def8a4506f3d4721f770b416ed25
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c67d0b199afa614a42569769cdc2344d9aa1607615deae8bbc4545d499da46ac
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 39618F22A086819AE7148F39D5047AC3B60FF04BADF484176DB5DD7795DF39E598C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A333A10 Relevance: 4.5, APIs: 3, Instructions: 33libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadLibraryW.KERNELBASE ref: 00007FF65A333A25
                                                                                                                                                                                                      • GetProcAddress.KERNEL32 ref: 00007FF65A333A42
                                                                                                                                                                                                      • FreeLibrary.KERNELBASE ref: 00007FF65A333A62
                                                                                                                                                                                                        • Part of subcall function 00007FF65A3339C0: GetLastError.KERNEL32(?,?,?,00007FF65A333B80,?,?,?,00007FF65A3342C9,?,?,?,?,00007FF65A331031), ref: 00007FF65A3339C6
                                                                                                                                                                                                        • Part of subcall function 00007FF65A3339C0: RaiseException.KERNEL32(?,?,?,00007FF65A333B80,?,?,?,00007FF65A3342C9,?,?,?,?,00007FF65A331031), ref: 00007FF65A3339FF
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Library$AddressErrorExceptionFreeLastLoadProcRaise
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 386220097-0
                                                                                                                                                                                                      • Opcode ID: 55289a7fcf567d6fc37604f5a9609b51a8c42d30ea13611f0b10e3126723dc72
                                                                                                                                                                                                      • Instruction ID: 6141d95be626738336cca45e4c8e820f85262464c41be90d443623eced8b7bec
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 55289a7fcf567d6fc37604f5a9609b51a8c42d30ea13611f0b10e3126723dc72
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1EF06221A0C78282FA544B5A7844239A2A5AF98BD8F1CD4B6DDDEE7744EE3CD841C300
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A340820 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                      • API String ID: 3013587201-537541572
                                                                                                                                                                                                      • Opcode ID: 847e315448d33ec932bdacaf819cbf365cdad76815bf1637d6656b56f8522315
                                                                                                                                                                                                      • Instruction ID: 71a86dfc27bd696f1e14c6d1f7cbb6b10e325313a059efb389d1286805a477ce
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 847e315448d33ec932bdacaf819cbf365cdad76815bf1637d6656b56f8522315
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A411622B1960241FF51DB1699081B963A1BF4BBE8F0C85B5DD8DE7798EE3EE445C340
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334BDC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 67libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressCommandHandleLineModuleProc
                                                                                                                                                                                                      • String ID: SetDefaultDllDirectories$kernel32.dll$unregister$user
                                                                                                                                                                                                      • API String ID: 147197560-815688805
                                                                                                                                                                                                      • Opcode ID: 5709c1a7cf0b43fb8a302db99dfee1deae5af6bda4fbedd289ff6e36927d3558
                                                                                                                                                                                                      • Instruction ID: 10822575d69c9d47e1831dd6ce70c2557c9e52f69f043e8667785c91097ac3e9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5709c1a7cf0b43fb8a302db99dfee1deae5af6bda4fbedd289ff6e36927d3558
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E6219522B1CA4292DF109B28E4441AD6360FF84BB9B485372E6ADD72E5DF6CD549C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334A9C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpenOverridePredef
                                                                                                                                                                                                      • String ID: Software\Classes
                                                                                                                                                                                                      • API String ID: 2630863477-1656466771
                                                                                                                                                                                                      • Opcode ID: c313f1374a35ba85ed93cb0d8f175837ed073ca8541d3e038ce952050618a241
                                                                                                                                                                                                      • Instruction ID: c817d48ce0b70e3221f8756f9fa060323be8bf202c9ce497a5183ce696895a25
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c313f1374a35ba85ed93cb0d8f175837ed073ca8541d3e038ce952050618a241
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6FF0C221B1C71285EB508BBDA88433A67A0EF447A9F580375DFEDD26E4EF1DD088D614
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334148 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 157stringCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 87 7ff65a334148-7ff65a334193 call 7ff65a3318e4 call 7ff65a331768 call 7ff65a3318e4 call 7ff65a331e1c 96 7ff65a334199-7ff65a3341ac lstrcmpiW 87->96 97 7ff65a334224-7ff65a33424c call 7ff65a331230 call 7ff65a33147c 87->97 99 7ff65a3341db-7ff65a3341ed 96->99 100 7ff65a3341ae-7ff65a3341d6 call 7ff65a33b924 call 7ff65a333cd4 * 2 96->100 113 7ff65a3343ef-7ff65a334420 call 7ff65a331230 97->113 114 7ff65a334252-7ff65a3342a3 InitializeCriticalSection call 7ff65a33147c 97->114 103 7ff65a3341f8-7ff65a334203 99->103 104 7ff65a3341ef-7ff65a3341f2 99->104 100->99 107 7ff65a334211-7ff65a334223 103->107 108 7ff65a334205-7ff65a33420b 103->108 104->103 108->107 122 7ff65a334422-7ff65a33442c 113->122 123 7ff65a3342a9-7ff65a3342d2 call 7ff65a333acc 114->123 124 7ff65a3343e4-7ff65a3343ee call 7ff65a331230 114->124 125 7ff65a33444d-7ff65a3344a4 call 7ff65a331ac4 call 7ff65a3347b4 call 7ff65a331ac4 122->125 126 7ff65a33442e-7ff65a33443c 122->126 136 7ff65a3342d4-7ff65a3342fe call 7ff65a332f40 call 7ff65a33b924 call 7ff65a333cd4 123->136 137 7ff65a334303-7ff65a33432f call 7ff65a331a28 123->137 124->113 128 7ff65a334449-7ff65a33444b 126->128 129 7ff65a33443e-7ff65a334441 126->129 128->122 129->128 136->137 147 7ff65a33433a-7ff65a33434e 137->147 148 7ff65a334331-7ff65a334334 137->148 151 7ff65a334359-7ff65a3343ba call 7ff65a336840 call 7ff65a334148 call 7ff65a332f40 147->151 152 7ff65a334350-7ff65a334353 147->152 148->147 161 7ff65a3343bc-7ff65a3343bf 151->161 162 7ff65a3343c5-7ff65a3343d3 call 7ff65a3344a8 151->162 152->151 161->162 164 7ff65a3343d8-7ff65a3343e3 162->164
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF65A3318E4: PathRemoveExtensionW.SHLWAPI(?,?,?,00007FF65A334166,?,?,?,00007FF65A334397,?,?,?,?,00007FF65A331031), ref: 00007FF65A331940
                                                                                                                                                                                                        • Part of subcall function 00007FF65A331768: VirtualQuery.KERNEL32 ref: 00007FF65A33178F
                                                                                                                                                                                                      • lstrcmpiW.KERNELBASE(?,?,?,00007FF65A334397,?,?,?,?,00007FF65A331031), ref: 00007FF65A3341A4
                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF65A331031), ref: 00007FF65A334278
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalExtensionInitializePathQueryRemoveSectionVirtuallstrcmpi
                                                                                                                                                                                                      • String ID: BraveUpdate.ini$SystemDrive
                                                                                                                                                                                                      • API String ID: 4116145752-4063966519
                                                                                                                                                                                                      • Opcode ID: 585b218e4b01064a166878589254a93d65b6c1fbbbc0224284a16055a9a10c7f
                                                                                                                                                                                                      • Instruction ID: 9b7fb7cf8af20befaeda27eff4578933699a468e74135b7b536fc7c26efc4918
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 585b218e4b01064a166878589254a93d65b6c1fbbbc0224284a16055a9a10c7f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE719322A1CA4282EB04DF29D84127C73A0FF85BA8F484272EA9DD77E5EF6CD555C740
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334F20 Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2303962521-0
                                                                                                                                                                                                      • Opcode ID: 932f7c441bc12c5655ae164f97e963ba30f4104fa42af6b90cedcf4448ca8a13
                                                                                                                                                                                                      • Instruction ID: ae1beb23c278b424dee21b3f3eadd9d17367f32301f9b3d3f8d91f9ae3e60aed
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 932f7c441bc12c5655ae164f97e963ba30f4104fa42af6b90cedcf4448ca8a13
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8314F21E0C1034AFA14AB65D4523BD63919F4178EF5C40B7E6CEEB2E7DE6EA444C781
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334230 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 140COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF65A331031), ref: 00007FF65A334278
                                                                                                                                                                                                        • Part of subcall function 00007FF65A33147C: GetProcessHeap.KERNEL32 ref: 00007FF65A3314F2
                                                                                                                                                                                                        • Part of subcall function 00007FF65A33147C: _Init_thread_footer.LIBCMT ref: 00007FF65A331527
                                                                                                                                                                                                        • Part of subcall function 00007FF65A33147C: _Init_thread_footer.LIBCMT ref: 00007FF65A331590
                                                                                                                                                                                                        • Part of subcall function 00007FF65A333ACC: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF65A3342C9,?,?,?,?,00007FF65A331031), ref: 00007FF65A333B0E
                                                                                                                                                                                                        • Part of subcall function 00007FF65A333ACC: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF65A3342C9,?,?,?,?,00007FF65A331031), ref: 00007FF65A333B46
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EnvironmentInit_thread_footerVariable$CriticalHeapInitializeProcessSection
                                                                                                                                                                                                      • String ID: BraveUpdate.ini$SystemDrive
                                                                                                                                                                                                      • API String ID: 3489650459-4063966519
                                                                                                                                                                                                      • Opcode ID: 782f436498ff015fde4b1bd4292e48b90e57d713d0d7b6be53d8b12ac70cae73
                                                                                                                                                                                                      • Instruction ID: 81790ffb7644040596fb3a57118dd74c197af24d309cd81a83eea34a91f54ee9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 782f436498ff015fde4b1bd4292e48b90e57d713d0d7b6be53d8b12ac70cae73
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AB618321A1CA8692EB04DF28E44127C73A0FF85768F484276E6AED36E5DF7CE454C740
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33CE04 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                      • Opcode ID: 56bc4b33e30ecd438373de69222ac63f6b51fdce199bb6f9000f6194c878a1e3
                                                                                                                                                                                                      • Instruction ID: 2c9a055e9646a7e724f2fc03b4160b0ede260bac6eef3771f5724e7e9a9d663a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 56bc4b33e30ecd438373de69222ac63f6b51fdce199bb6f9000f6194c878a1e3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBD09E11F1C60642EA547B70685D17812156F48B0AF1815BDC88FE63A3DD2DA40DC300
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A332568 Relevance: 3.2, APIs: 2, Instructions: 240COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 297 7ff65a332568-7ff65a3325a0 call 7ff65a331aec call 7ff65a332be4 302 7ff65a3325e2-7ff65a3325fa CommandLineToArgvW 297->302 303 7ff65a3325a2-7ff65a3325ce call 7ff65a3317a8 call 7ff65a332f40 297->303 304 7ff65a332608-7ff65a33260e 302->304 305 7ff65a3325fc-7ff65a332603 call 7ff65a3339c0 302->305 321 7ff65a3325d9-7ff65a3325dd call 7ff65a333f80 303->321 322 7ff65a3325d0-7ff65a3325d3 303->322 308 7ff65a332856 304->308 309 7ff65a332614-7ff65a332666 call 7ff65a3332f4 * 2 304->309 315 7ff65a332864-7ff65a332879 305->315 313 7ff65a33285b-7ff65a33285e LocalFree 308->313 325 7ff65a332668-7ff65a33266a 309->325 326 7ff65a33266f-7ff65a33267a call 7ff65a33147c 309->326 313->315 319 7ff65a33287b-7ff65a33287e 315->319 320 7ff65a332884-7ff65a33289d 315->320 319->320 321->302 322->321 325->313 329 7ff65a332680-7ff65a332695 326->329 330 7ff65a33289e-7ff65a3328ab call 7ff65a331230 326->330 334 7ff65a33269b 329->334 335 7ff65a3327d2-7ff65a3327e7 329->335 336 7ff65a3326a0-7ff65a3326c5 call 7ff65a331aec call 7ff65a332be4 call 7ff65a3328ac 334->336 335->325 337 7ff65a3327ed-7ff65a3327f6 335->337 345 7ff65a3326f8-7ff65a3326ff call 7ff65a332904 336->345 346 7ff65a3326c7-7ff65a3326d4 call 7ff65a332998 336->346 337->325 351 7ff65a332780-7ff65a33279e call 7ff65a3322e8 345->351 352 7ff65a332701-7ff65a33270c call 7ff65a332904 345->352 353 7ff65a3326da-7ff65a3326ea call 7ff65a332208 346->353 354 7ff65a3327fb 346->354 366 7ff65a332848-7ff65a332854 351->366 367 7ff65a3327a4-7ff65a3327b7 351->367 368 7ff65a332841-7ff65a332846 352->368 369 7ff65a332712-7ff65a332751 call 7ff65a332b4c call 7ff65a332998 352->369 353->354 363 7ff65a3326f0-7ff65a3326f3 353->363 355 7ff65a3327ff-7ff65a332803 354->355 359 7ff65a332807-7ff65a332814 355->359 364 7ff65a332816-7ff65a332819 359->364 365 7ff65a33281f-7ff65a332834 359->365 363->367 364->365 365->313 370 7ff65a332836-7ff65a33283f 365->370 366->359 371 7ff65a3327b9-7ff65a3327bc 367->371 372 7ff65a3327c2-7ff65a3327c8 367->372 368->354 379 7ff65a33275c-7ff65a33275e 369->379 380 7ff65a332753-7ff65a332756 369->380 370->313 371->372 372->336 375 7ff65a3327ce 372->375 375->335 379->355 381 7ff65a332764-7ff65a332775 call 7ff65a332208 379->381 380->379 381->355 384 7ff65a33277b-7ff65a33277e 381->384 384->367
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CommandLineToArgvW.SHELL32 ref: 00007FF65A3325EE
                                                                                                                                                                                                        • Part of subcall function 00007FF65A3317A8: GetModuleFileNameW.KERNEL32(?,?,?,00007FF65A3318AF,?,?,?,00007FF65A331900,?,?,?,00007FF65A334166,?,?,?,00007FF65A334397), ref: 00007FF65A33181F
                                                                                                                                                                                                      • LocalFree.KERNEL32 ref: 00007FF65A33285E
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ArgvCommandFileFreeLineLocalModuleName
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 871553864-0
                                                                                                                                                                                                      • Opcode ID: 68d2023c3308c72c8f942df7f976dc653d2697b746f26bdb1623dfaa2d38b52a
                                                                                                                                                                                                      • Instruction ID: 0830816c9dc6a46aee4ad35ae9bc7f38949191d03126b7389fdd9f0b36a26770
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 68d2023c3308c72c8f942df7f976dc653d2697b746f26bdb1623dfaa2d38b52a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FAA15362B08A4286EB109FA9C8402BD2761FF54BBCB488272DE6DE77E5DF78D445C340
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33CD35 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3947729631-0
                                                                                                                                                                                                      • Opcode ID: ab5672b8206b1259b8ff5942ab4e8ee7d0982f89718f223ccbdc1d18da8d6cb8
                                                                                                                                                                                                      • Instruction ID: 4ec81e26dcd1e31764969038abf5ab30bba06d860ef6b2de1958748322f4aebf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab5672b8206b1259b8ff5942ab4e8ee7d0982f89718f223ccbdc1d18da8d6cb8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 68219176A18B0589EB648F68C4802EC37B0EF4471CF580676E69DA6AE5DF38D45AC740
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A3432A0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 03759c3ce407c5307847b7b93929e8982ebd359f1e2c61a00043aec005732ce4
                                                                                                                                                                                                      • Instruction ID: 4116c269758fa297b4e2bc2d11d64c42a3a738acbb1486307171edcc6a3e5d83
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 03759c3ce407c5307847b7b93929e8982ebd359f1e2c61a00043aec005732ce4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D116A3290C68282F2109F18E445139B3A4FF88748F4D44B5E6DEE7792DF3DE8108B00
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A340CC0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF65A34065E,?,?,00000004,00007FF65A33B90D,?,?,?,?,00007FF65A34148A,?,?,00000000), ref: 00007FF65A340D15
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                      • Opcode ID: 3759019bf3abfeebbe8fbdaa3811d609cf2ed7db6f0fb0c2878c2b7c67cbfc2f
                                                                                                                                                                                                      • Instruction ID: d1ec952e4dc393469d691abb6d0cb4ae3e13ef714723aa996ab107c67efa692d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3759019bf3abfeebbe8fbdaa3811d609cf2ed7db6f0fb0c2878c2b7c67cbfc2f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90F09050F0D70B80FE689B6659093B502801F8BB8CF4C58F5DD8EEA3C2ED2DF8858220
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334A6C Relevance: 1.5, APIs: 1, Instructions: 15registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 467 7ff65a334a6c-7ff65a334a83 RegOverridePredefKey 468 7ff65a334a94 467->468 469 7ff65a334a85-7ff65a334a92 467->469 470 7ff65a334a96-7ff65a334a9a 468->470 469->470
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: OverridePredef
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 898253552-0
                                                                                                                                                                                                      • Opcode ID: a54fe31a83ffca700cab3f2df1340a5a0451b92f8e500fe702df7ff68e3a2b60
                                                                                                                                                                                                      • Instruction ID: 9b9d97d0e1ffeea35cdaafc6ed01f33cc327fba250ca866848c13b0305ef72d3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a54fe31a83ffca700cab3f2df1340a5a0451b92f8e500fe702df7ff68e3a2b60
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DBD0A920B2E80381EB48A2370C1033A40C06F84632FA80679CAAEC02E0FD0CC4819008
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00007FF65A33498C Relevance: 13.5, APIs: 9, Instructions: 42clipboardmemorystringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlocklstrlen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2633044538-0
                                                                                                                                                                                                      • Opcode ID: 6352fce9b027cbcad951bd88884d2899684f12d3dcad91e103972fcb2fd759b9
                                                                                                                                                                                                      • Instruction ID: 6bb06faf886d6c53201fe5f52cef054b17671fd153f4375c1d01595e3abb2d9a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6352fce9b027cbcad951bd88884d2899684f12d3dcad91e103972fcb2fd759b9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24010020B0D74246FE145B61B94C1796395EF49FC9F0C40B9DA8EE77A9EE2EE445C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A335994 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3140674995-0
                                                                                                                                                                                                      • Opcode ID: 856f282e32df8d73fe04972479197951aa21ac118391512de7235e9480e850fc
                                                                                                                                                                                                      • Instruction ID: 4e97e83dbe6e0e182f980385c1fc4cead64818774857e0a1039588ce7cab6ed7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 856f282e32df8d73fe04972479197951aa21ac118391512de7235e9480e850fc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B314172609B818AEB609F60E8443EE7364FB84749F48407ADA8ED7B94EF3DD548C710
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33B4C8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1239891234-0
                                                                                                                                                                                                      • Opcode ID: 6dbf2d4e52e93027aaca7cf5313114e00885297a862569c248cde5624a2a885f
                                                                                                                                                                                                      • Instruction ID: 8d30ade34b030645b0c1b56c4c8f175470348e02512b9de35ff23c2196b51da4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6dbf2d4e52e93027aaca7cf5313114e00885297a862569c248cde5624a2a885f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76315232608B8186EB60CF25E8442AE73A4FF88758F540276EA9DD7B65EF3CD545CB00
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334CE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF65A334D6B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                                                                                                                                      • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                      • API String ID: 450123788-631824599
                                                                                                                                                                                                      • Opcode ID: 6d4ae9a61894bf9dc68d31e19d5d557322089d6c62bf4dfdcca0423adfd2fa08
                                                                                                                                                                                                      • Instruction ID: 871eb28da646c516d51d6cd4f05d85187924a1788de7e47d758f4c3ed3a76bcb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d4ae9a61894bf9dc68d31e19d5d557322089d6c62bf4dfdcca0423adfd2fa08
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 65115E32A18B8297E7449B22E6443B933A0FF44349F4841B6D79DD6A51EF3DE0B4C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A335300 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                                                      • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                                                      • API String ID: 2565136772-3242537097
                                                                                                                                                                                                      • Opcode ID: d0932d7c438688d582f413cb499b0fb58ae1f7555594c2062416a4d41a1e6a08
                                                                                                                                                                                                      • Instruction ID: e60e4d0cd38004832f8ae4ca0a5fed7ce73d3ea723aab3494f178ebaecbe9052
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d0932d7c438688d582f413cb499b0fb58ae1f7555594c2062416a4d41a1e6a08
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A9210120E1DB0385FE559B54FC582B863A0AF4875AF4C05F6D98EE26A4FF6DE445C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33889C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 312COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 3606184308-393685449
                                                                                                                                                                                                      • Opcode ID: 5938e31c2149abbec4c5cfa09968dd6a3a4af182ad2785b0433422f5d76a9126
                                                                                                                                                                                                      • Instruction ID: 1a52cefccbff7a1e7e7ede7217ae0725feb27707a10f1e40c89cde5687620078
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5938e31c2149abbec4c5cfa09968dd6a3a4af182ad2785b0433422f5d76a9126
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6D16D72A0CB428AEB209B65D4412AD7BA0FF4579CF180576EE8DE7B95CF38E091C701
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33AFBC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF65A33B26E,?,?,?,00007FF65A337F1C,?,?,?,?,00007FF65A336CE5), ref: 00007FF65A33B041
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF65A33B26E,?,?,?,00007FF65A337F1C,?,?,?,?,00007FF65A336CE5), ref: 00007FF65A33B04F
                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF65A33B26E,?,?,?,00007FF65A337F1C,?,?,?,?,00007FF65A336CE5), ref: 00007FF65A33B079
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF65A33B26E,?,?,?,00007FF65A337F1C,?,?,?,?,00007FF65A336CE5), ref: 00007FF65A33B0BF
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF65A33B26E,?,?,?,00007FF65A337F1C,?,?,?,?,00007FF65A336CE5), ref: 00007FF65A33B0CB
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                      • API String ID: 2559590344-2084034818
                                                                                                                                                                                                      • Opcode ID: f8e1ab219166680134276f99460196be67dd5d4fd441d943d03bdf1987045396
                                                                                                                                                                                                      • Instruction ID: d82544f3b40fb517bdddf57e0b88c6d3621fdf44c873575af56b30f90b6382c2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f8e1ab219166680134276f99460196be67dd5d4fd441d943d03bdf1987045396
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3D31F421B1EA4291EE11DF12A804575A3A4FF09BA8F1D85B6DDADEB790EF3CE040C300
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334878 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExitMessageProcesswsprintf
                                                                                                                                                                                                      • String ID: Exception$Exception %x in %s %s %u%hs:%d$base\logging.cc
                                                                                                                                                                                                      • API String ID: 1070390611-1730742759
                                                                                                                                                                                                      • Opcode ID: 7bc731f639765bbc45b412fa4d5d969e96db5bb59056e3641ba6b012cfbdfdd4
                                                                                                                                                                                                      • Instruction ID: d608db38f8727772779b54d3a024739c10da606bf691f2c18bbae2400cab467e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7bc731f639765bbc45b412fa4d5d969e96db5bb59056e3641ba6b012cfbdfdd4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5F31C532A1CA8681E710CB24E44026E73A0FF89769F584272EA9DD36D4DF7DD545CB40
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A340484 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                      • Opcode ID: 337752e74d537d3fb1c8ed90e055371beaa0f34e4c906e10c9e35874f69b4d59
                                                                                                                                                                                                      • Instruction ID: edb23435ff20ecd623b5d5829604cbdd09b4a5668256581e49223ef18d90fc14
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 337752e74d537d3fb1c8ed90e055371beaa0f34e4c906e10c9e35874f69b4d59
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 88214C20B0D64242FA54A735554D0396252AF8A7B8F1C07F4D9FEEABC6EE2EE4018A00
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A347570 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                      • String ID: CONOUT$
                                                                                                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                                                                                                      • Opcode ID: 6744946ae0f340affcf5deff357b5612c7dd714733c0c5371dfc196223539289
                                                                                                                                                                                                      • Instruction ID: 82d3886595e12e42975bcf56fc612b0e5a3190fd1063d91a25abac1d8d980ea8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6744946ae0f340affcf5deff357b5612c7dd714733c0c5371dfc196223539289
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D118131A18A4187E7508B56E85832977A4FF88BE8F080274DA9DD7794DF3DD8448740
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A338D64 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 316COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 3523768491-393685449
                                                                                                                                                                                                      • Opcode ID: 26591c802a4259b13b1d66d889a493b927fbcf5d2857e053d389529106b2bb99
                                                                                                                                                                                                      • Instruction ID: f15de781b4d8560096cfc7b1b17343e00728d9c0b8abe99364c1273600be37e4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 26591c802a4259b13b1d66d889a493b927fbcf5d2857e053d389529106b2bb99
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E0E19D32A0CB828AEB20DB65D4942AD7BA0FF4574CF184176DA8DE7796DF38E585C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A3405FC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,00000004,00007FF65A33B90D,?,?,?,?,00007FF65A34148A,?,?,00000000,00007FF65A33BF83,?,?,?), ref: 00007FF65A34060B
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,00000004,00007FF65A33B90D,?,?,?,?,00007FF65A34148A,?,?,00000000,00007FF65A33BF83,?,?,?), ref: 00007FF65A340641
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,00000004,00007FF65A33B90D,?,?,?,?,00007FF65A34148A,?,?,00000000,00007FF65A33BF83,?,?,?), ref: 00007FF65A34066E
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,00000004,00007FF65A33B90D,?,?,?,?,00007FF65A34148A,?,?,00000000,00007FF65A33BF83,?,?,?), ref: 00007FF65A34067F
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,00000004,00007FF65A33B90D,?,?,?,?,00007FF65A34148A,?,?,00000000,00007FF65A33BF83,?,?,?), ref: 00007FF65A340690
                                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,00000004,00007FF65A33B90D,?,?,?,?,00007FF65A34148A,?,?,00000000,00007FF65A33BF83,?,?,?), ref: 00007FF65A3406AB
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                      • Opcode ID: 5712cc44fb3870e7da7360faa01941ab53d3bfd94e8f330285dac57dd783fb5b
                                                                                                                                                                                                      • Instruction ID: 560ea08dee50f0bf7298fdc970a6ef6c9c2be964ffa6ca5d7042fec5c8762cb4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5712cc44fb3870e7da7360faa01941ab53d3bfd94e8f330285dac57dd783fb5b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 67116D20F0D24241FA94A736555D03962929F8A7B8F1C47F5D8EFEB6D6EE3EF4018A00
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33CE68 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                      • Opcode ID: 8fa0014bd8cc9ad319b709363effa9625d4e159ced705655add725fefc1abf70
                                                                                                                                                                                                      • Instruction ID: 71cb4d9a5a1315a23cbedc6bcf27583c12b353bba61efd7575a41a1a926714c7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8fa0014bd8cc9ad319b709363effa9625d4e159ced705655add725fefc1abf70
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 19F06221B0970681EB108B24E45C37A5320AF45769F584676C5AED56F4DF3ED448C300
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33816C Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AdjustPointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1740715915-0
                                                                                                                                                                                                      • Opcode ID: 4da5706cdb9565c04f999259001dba51b02a0139d752611930c9d8ada5766754
                                                                                                                                                                                                      • Instruction ID: 3370e2af7c984b1012a2441b5180da104c1d45c11f7b8b9d3eea7d0f6299b5b2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4da5706cdb9565c04f999259001dba51b02a0139d752611930c9d8ada5766754
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 01B18E22E0EA4281FE65DF15A4412796A90AF54B9CF0D88B7EECDE7785DF6CE442C340
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A346488 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _set_statfp
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1156100317-0
                                                                                                                                                                                                      • Opcode ID: 873ddd27d6e11e6a5cebdd6bc92ecbbe564fd9246daab4c3561fdf3265e0169f
                                                                                                                                                                                                      • Instruction ID: d62a3aa4e89526c92f0031ce29a9dec387b9c6bbaaa381a6e250c7fe1c22fc18
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 873ddd27d6e11e6a5cebdd6bc92ecbbe564fd9246daab4c3561fdf3265e0169f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 74115122E5CA1305FB682928E45E37910816F543BCF1C46F4EAEEF67DF9F1EA8414100
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A3406C4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF65A33B457,?,?,00000000,00007FF65A33B6F2,?,?,?,?,?,00007FF65A33B67E), ref: 00007FF65A3406E3
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF65A33B457,?,?,00000000,00007FF65A33B6F2,?,?,?,?,?,00007FF65A33B67E), ref: 00007FF65A340702
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF65A33B457,?,?,00000000,00007FF65A33B6F2,?,?,?,?,?,00007FF65A33B67E), ref: 00007FF65A34072A
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF65A33B457,?,?,00000000,00007FF65A33B6F2,?,?,?,?,?,00007FF65A33B67E), ref: 00007FF65A34073B
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF65A33B457,?,?,00000000,00007FF65A33B6F2,?,?,?,?,?,00007FF65A33B67E), ref: 00007FF65A34074C
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                      • Opcode ID: 3669e3dd6e8265979d328106abaed9e5f17b47101b1df01aae37e84564e7dc0f
                                                                                                                                                                                                      • Instruction ID: e2d96326ffaeef5da5422786859edf04365c70bc62e758835a621e5b46758a8f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3669e3dd6e8265979d328106abaed9e5f17b47101b1df01aae37e84564e7dc0f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A118120F0D30341FA586335554917926415F8A7B8F1C47F4D8FEE66D6EE3EF4018A01
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A340558 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                      • Opcode ID: 4f6461fc046f75d7c704ca68a7f15aa9e848f7d45c219bc67483a711a6206271
                                                                                                                                                                                                      • Instruction ID: c2ba1ba7a01523de2d4d8490bd9b4c4d5dc261b1f98ce0fb869aae3c0fa7e4bd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f6461fc046f75d7c704ca68a7f15aa9e848f7d45c219bc67483a711a6206271
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0511F720F0D20742F958A375545947922619F4A37CF1C0BF5D9FEEA2D2EE3EF4418A01
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A3347FC Relevance: 7.5, APIs: 5, Instructions: 30sleepCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CountCriticalEnterSectionTick$Sleep
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1544504822-0
                                                                                                                                                                                                      • Opcode ID: d7e02f4f289bb2db9ce91d24be9f87c42b2c0c2816f87d5be78a77ea46c855c7
                                                                                                                                                                                                      • Instruction ID: 03b08932550154988bc8dac98fe5f47cd13ab609bb9e8b710b207ffbf1b56265
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d7e02f4f289bb2db9ce91d24be9f87c42b2c0c2816f87d5be78a77ea46c855c7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D1F09021A0C68282EB108F35B54907D6360EF48B8DB0851B5DA9EE7764EF2EE485C300
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A339478 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                                                                                                      • Opcode ID: b6fc49948377dbb17c79eb66b37f6f8a3153f90d6d985a9f30fed9b3837e03c0
                                                                                                                                                                                                      • Instruction ID: 91e6cbcb8a6e5753c75318a57207ca15ee7a4982760d16b7e2cee8b36b6b524c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b6fc49948377dbb17c79eb66b37f6f8a3153f90d6d985a9f30fed9b3837e03c0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E791AD73A09781CAE751CB65E8902AD7BB0FB04798F18416AEA8DA7755EF38D191CB00
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A339260 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                                                                                                      • Opcode ID: 0ba2e5d5ee8c16ecea0c98da0d86f313a25d7fe570d73a396aa5ff547c76d6c9
                                                                                                                                                                                                      • Instruction ID: 5d71d4b1c2e661e3ec4fd1015795e861f5f35fedb24119c6744f5745ac0a5d62
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0ba2e5d5ee8c16ecea0c98da0d86f313a25d7fe570d73a396aa5ff547c76d6c9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F514872A08B85CAE720CF65D0412AD77A0FB44B8CF084166EF8DA7B99DF78E145C740
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A3399EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                      • String ID: csm$csm
                                                                                                                                                                                                      • API String ID: 3896166516-3733052814
                                                                                                                                                                                                      • Opcode ID: 3712c0d4f12c1149fd05604199ca1cc57295d877ee970cbb819e1eb600357671
                                                                                                                                                                                                      • Instruction ID: 56c3c900f9128a8e1ab2a4fc235fce359adf049b3a76c1e64e6b1d0b7ad686e2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3712c0d4f12c1149fd05604199ca1cc57295d877ee970cbb819e1eb600357671
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E517C3290C682C7EB648B15949426876A0FF54B98F184277DACDE7BD5DF3CE490CB01
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A3457CC Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2718003287-0
                                                                                                                                                                                                      • Opcode ID: 558573b1c91571b686ab66984aeb02d817c8bfb1d7119360fd03e322ea697503
                                                                                                                                                                                                      • Instruction ID: 01d3be3001844a6df3e6997608e9eb95044256ad9f1f204bc064251f4b9ded0f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 558573b1c91571b686ab66984aeb02d817c8bfb1d7119360fd03e322ea697503
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BD1CF22F08A858AE711CF79D4442AC37B1FB44B9CB184276DE9DE7B99DE79D806C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A346110 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF65A3460B0), ref: 00007FF65A346233
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF65A3460B0), ref: 00007FF65A3462BD
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 953036326-0
                                                                                                                                                                                                      • Opcode ID: 039988a083969568b42bf290a041371ef1dd6a4258fc4d1a49b43e5c6b676dc4
                                                                                                                                                                                                      • Instruction ID: a7f50d1aa76bdb902e3acdbcfa1d950aa814a4703b4d7b814c246895731687a9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 039988a083969568b42bf290a041371ef1dd6a4258fc4d1a49b43e5c6b676dc4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D91E172E18A9285FB508F6594482BD6BA0FF04B8CF4841B6DE8EF7695DF3AD445C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A334DC4 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,00007FF65A331324,?,?,?,00007FF65A331B30,?,?,?,00007FF65A333E07), ref: 00007FF65A334DE2
                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,00007FF65A331324,?,?,?,00007FF65A331B30,?,?,?,00007FF65A333E07), ref: 00007FF65A334E00
                                                                                                                                                                                                      • _set_fmode.LIBCMT ref: 00007FF65A334E53
                                                                                                                                                                                                      • _RTC_Initialize.LIBCMT ref: 00007FF65A334E74
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CriticalSection$EnterInitializeLeave_set_fmode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2803588085-0
                                                                                                                                                                                                      • Opcode ID: 034e50919c5ab0792a7cba575e5add851db26900540ec2dfc135d57f6124a83b
                                                                                                                                                                                                      • Instruction ID: 908d93e9cdc2342de4e98af6ee4495b4647f10999cd4f6cde5cedc3a2bf35686
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 034e50919c5ab0792a7cba575e5add851db26900540ec2dfc135d57f6124a83b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 35315C11E0C6468AFA64B7B1A4421BD6260AF9475AF0C04B3EBCEE76D3DE2CF441C311
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A339C24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __except_validate_context_record
                                                                                                                                                                                                      • String ID: csm$csm
                                                                                                                                                                                                      • API String ID: 1467352782-3733052814
                                                                                                                                                                                                      • Opcode ID: 376617b287ec064cc8087895f8245221c5592c5f98e766c62e2617e735b440cd
                                                                                                                                                                                                      • Instruction ID: b6883d730e9dfcfba0f3ee1e8211f2105198c25495b9d829d135c3e82b5e3546
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 376617b287ec064cc8087895f8245221c5592c5f98e766c62e2617e735b440cd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B718A32A0C681CBDB618B2594A067D7BA0EF45B89F188176DACCE7B85EF3CD590C741
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A33A254 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateFrameInfo__except_validate_context_record
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 2558813199-1018135373
                                                                                                                                                                                                      • Opcode ID: e0e163a061f5fd86d3b0bc4f115189f4d0de6791220c887537f2f0b5cbdb6146
                                                                                                                                                                                                      • Instruction ID: 058371cf25f801eed4c3ad3cc9a1433b36a64615535655f13862aa66672c85bf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e0e163a061f5fd86d3b0bc4f115189f4d0de6791220c887537f2f0b5cbdb6146
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81512C32A1C74186DA20EB15E4452BE7BB4FB88B94F18017AEBDD97B55CF38E461CB00
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A345E78 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                                      • String ID: U
                                                                                                                                                                                                      • API String ID: 442123175-4171548499
                                                                                                                                                                                                      • Opcode ID: 61e99a1328edc6c7ec8fa9f7610307a0d0c7835356aade33a271f142cd54f7cf
                                                                                                                                                                                                      • Instruction ID: de87421697df4cd730bfb30cda9a31a56eab80be9f2d2344dbe0edb1399b8c95
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 61e99a1328edc6c7ec8fa9f7610307a0d0c7835356aade33a271f142cd54f7cf
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1841A432B19A4186EB208F65E4483A9B7A1FF88798F494032EE8DD7758EF7DD441C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A3478E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __C_specific_handler.LIBVCRUNTIME ref: 00007FF65A3478F8
                                                                                                                                                                                                        • Part of subcall function 00007FF65A336AA8: __except_validate_context_record.LIBVCRUNTIME ref: 00007FF65A336AD3
                                                                                                                                                                                                        • Part of subcall function 00007FF65A336AA8: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FF65A336B68
                                                                                                                                                                                                        • Part of subcall function 00007FF65A336AA8: RtlUnwindEx.KERNEL32 ref: 00007FF65A336BB7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: C_specific_handlerCurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                      • String ID: csm$f
                                                                                                                                                                                                      • API String ID: 3112662972-629598281
                                                                                                                                                                                                      • Opcode ID: 75fe812e090a62ea16aaf9a07a0bae683ccfdb612d7947684b0b506522d6098b
                                                                                                                                                                                                      • Instruction ID: 4cfb2f9c294bb469031d55003c481880d4a842938e68ffe4a256c2d83241fefe
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 75fe812e090a62ea16aaf9a07a0bae683ccfdb612d7947684b0b506522d6098b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7AF0A02180C38284EA606B21E1882BC2EA0FF45748F1C98B5DADCD7386CF3DD8A0C204
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF65A337BFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65A3360BE), ref: 00007FF65A337C40
                                                                                                                                                                                                      • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65A3360BE), ref: 00007FF65A337C86
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000004.00000002.1765069227.00007FF65A331000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65A330000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765050166.00007FF65A330000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765090208.00007FF65A349000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765111910.00007FF65A359000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000004.00000002.1765129041.00007FF65A35D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff65a330000_BraveUpdateComRegisterShell64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 2573137834-1018135373
                                                                                                                                                                                                      • Opcode ID: 03777b1816255e2506ae4b714f773a70b19ae6a9c3f00a805364dd9ab622737b
                                                                                                                                                                                                      • Instruction ID: c54cc24ebebb164d43e3a70acd947aae7438e5ffaf59e5f423bfc39a6e0a3380
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 03777b1816255e2506ae4b714f773a70b19ae6a9c3f00a805364dd9ab622737b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AD112832618B8582EB208B15E4442697BE1FB88B98F584275EECD97B54EF3DD551CB00
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00071152 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 99processCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00071000: GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories,0007116C), ref: 0007100A
                                                                                                                                                                                                        • Part of subcall function 00071000: GetProcAddress.KERNEL32(00000000), ref: 00071011
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000207), ref: 0007119B
                                                                                                                                                                                                      • PathRemoveFileSpecW.SHLWAPI(?), ref: 000711BE
                                                                                                                                                                                                      • PathRemoveFileSpecW.SHLWAPI(?), ref: 000711D8
                                                                                                                                                                                                      • PathAppendW.SHLWAPI(?,BraveUpdate.exe), ref: 000711E6
                                                                                                                                                                                                      • CreateProcessW.KERNELBASE(00000000,00000022,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00071253
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 0007126A
                                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 00071272
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileHandlePath$CloseModuleRemoveSpec$AddressAppendCreateNameProcProcess
                                                                                                                                                                                                      • String ID: "$" /ondemand $BraveUpdate.exe$D
                                                                                                                                                                                                      • API String ID: 1697256010-3473998726
                                                                                                                                                                                                      • Opcode ID: 89b4a721c217170d8121ef7a0781ab654a1ad172f7ac8be19ff0e3e26bb5ee82
                                                                                                                                                                                                      • Instruction ID: 3b6b4ec47feeb1c9cd1b024bc69f3dd6d35b2733c72dfc8116fc0475db93cf3d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 89b4a721c217170d8121ef7a0781ab654a1ad172f7ac8be19ff0e3e26bb5ee82
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 343147F1D0021CAADF109B64DC49FDB77BCAB09344F4045A5A70DE2192DA7C9AC58EA9
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00077F35 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 23 77f35-77f41 24 77fd3-77fd6 23->24 25 77f46-77f57 24->25 26 77fdc 24->26 28 77f64-77f7d LoadLibraryExW 25->28 29 77f59-77f5c 25->29 27 77fde-77fe2 26->27 32 77fe3-77ff3 28->32 33 77f7f-77f88 GetLastError 28->33 30 77f62 29->30 31 77ffc-77ffe 29->31 35 77fd0 30->35 31->27 32->31 34 77ff5-77ff6 FreeLibrary 32->34 36 77fc1-77fce 33->36 37 77f8a-77f9c call 75708 33->37 34->31 35->24 36->35 37->36 40 77f9e-77fb0 call 75708 37->40 40->36 43 77fb2-77fbf LoadLibraryExW 40->43 43->32 43->36
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,00078042,000788AA,?,00000000,00000000,00000000,?,0007819C,00000021,FlsSetValue,0008000C,00080014,00000000), ref: 00077FF6
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-537541572
                                                                                                                                                                                                      • Opcode ID: 62c17d4fffc1a97909c98fb606a03fbb5f2d475a52cdfab455109bc8acb85201
                                                                                                                                                                                                      • Instruction ID: 7310962ada2623ffc002bcf378384c56b8bdaabccf6817371de44cefee5b8a0e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 62c17d4fffc1a97909c98fb606a03fbb5f2d475a52cdfab455109bc8acb85201
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C5212B71E09611E7EB319B20ED81A5B3798EF057B0F118170E90DA7291DB7CED00C6E8
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00074C21 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00074D34,?,00074C1B,00000000,?,?,00074D34,D43B8AE7,?,00074D34), ref: 00074C32
                                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000,?,00074C1B,00000000,?,?,00074D34,D43B8AE7,?,00074D34), ref: 00074C39
                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00074C4B
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                      • Opcode ID: dd6cb7f870d4e42d37b72b2ff07e5fc5ef45ef1394229bff3492b1e98617fc4f
                                                                                                                                                                                                      • Instruction ID: ba70ece330923741e4fea56251ec6efde63d41e2b131fa56124c20dad7fb30aa
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dd6cb7f870d4e42d37b72b2ff07e5fc5ef45ef1394229bff3492b1e98617fc4f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 21D09E31802188AFEF422F60DE0D99D3F69AF453417148450BA0D5A072CBBD99D1DA94
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00078000 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 51 78000-78028 52 7802e-78030 51->52 53 7802a-7802c 51->53 55 78036-7803d call 77f35 52->55 56 78032-78034 52->56 54 7807f-78082 53->54 58 78042-78046 55->58 56->54 59 78065-7807c 58->59 60 78048-78056 GetProcAddress 58->60 62 7807e 59->62 60->59 61 78058-78063 call 743c3 60->61 61->62 62->54
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: ab70a2eaff7d91e8b881d65b3f01c742a681bd31131d3dafff7dcaeb9db3ec91
                                                                                                                                                                                                      • Instruction ID: 1a361bd22d1ecc0639d257fae58d396c52586b10d1643729278e7ce919063f4b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab70a2eaff7d91e8b881d65b3f01c742a681bd31131d3dafff7dcaeb9db3ec91
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F601F137B406125FAF668E69EC4899A33D6BBC4360325C120FA0CDB199EE39D84997D4
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00071850 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0007185C
                                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 00071928
                                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00071948
                                                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(?), ref: 00071952
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 254469556-0
                                                                                                                                                                                                      • Opcode ID: 3fc0725ebcc23ea88ef43120701287dc18a2239d4840eb521bc4eaca5f810f97
                                                                                                                                                                                                      • Instruction ID: d842bf6d1520e9707768c00d6b108411b899546e25b158fcaf918fcfaf539fe2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3fc0725ebcc23ea88ef43120701287dc18a2239d4840eb521bc4eaca5f810f97
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BD311A75D02318DBDB10DF64D9897CCBBB8AF08340F1040DAE50DAB291EBB85A858F55
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0007341B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 172 7341b-73446 call 73fd9 175 737bf-737c4 call 7548a 172->175 176 7344c-7344f 172->176 176->175 177 73455-7345e 176->177 179 73464-73468 177->179 180 7355b-73561 177->180 179->180 182 7346e-73475 179->182 183 73569-73577 180->183 184 73477-7347e 182->184 185 7348d-73492 182->185 186 7357d-73581 183->186 187 73728-7372b 183->187 184->185 188 73480-73487 184->188 185->180 191 73498-734a0 call 724e3 185->191 186->187 192 73587-7358e 186->192 189 7374e-73757 call 724e3 187->189 190 7372d-73730 187->190 188->180 188->185 189->175 204 73759-7375d 189->204 190->175 194 73736-7374b call 737c5 190->194 191->204 209 734a6-734bf call 724e3 * 2 191->209 196 735a6-735ac 192->196 197 73590-73597 192->197 194->189 200 736c4-736c8 196->200 201 735b2-735d9 call 7288c 196->201 197->196 198 73599-735a0 197->198 198->187 198->196 206 736d4-736e0 200->206 207 736ca-736d3 call 72170 200->207 201->200 215 735df-735e2 201->215 206->189 213 736e2-736e6 206->213 207->206 209->175 230 734c5-734cb 209->230 217 736f8-73700 213->217 218 736e8-736f0 213->218 222 735e5-735fa 215->222 219 73717-73724 call 73e94 217->219 220 73702-73715 call 724e3 * 2 217->220 218->189 223 736f2-736f6 218->223 237 73726 219->237 238 73783-73798 call 724e3 * 2 219->238 245 7375e call 753ce 220->245 227 736a5-736b8 222->227 228 73600-73603 222->228 223->189 223->217 227->222 231 736be-736c1 227->231 228->227 233 73609-73611 228->233 235 734f7-734ff call 724e3 230->235 236 734cd-734d1 230->236 231->200 233->227 239 73617-7362b 233->239 256 73563-73566 235->256 257 73501-73521 call 724e3 * 2 call 73e94 235->257 236->235 241 734d3-734da 236->241 237->189 264 7379d-737ba call 72a7f call 73d94 call 73f51 call 73d0b 238->264 265 7379a 238->265 242 7362e-7363e 239->242 246 734ee-734f1 241->246 247 734dc-734e3 241->247 248 73666-73673 242->248 249 73640-73653 call 738fb 242->249 260 73763-7377e call 72170 call 73aa6 call 74086 245->260 246->175 246->235 247->246 254 734e5-734ec 247->254 248->242 252 73675 248->252 267 73677-7369f call 7339b 249->267 268 73655-7365b 249->268 259 736a2 252->259 254->235 254->246 256->183 257->256 285 73523-73528 257->285 259->227 260->238 264->175 265->264 267->259 268->249 274 7365d-73663 268->274 274->248 285->245 287 7352e-73541 call 73afb 285->287 287->260 292 73547-73553 287->292 292->245 293 73559 292->293 293->287
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 00073518
                                                                                                                                                                                                      • type_info::operator==.LIBVCRUNTIME ref: 0007353A
                                                                                                                                                                                                      • ___TypeMatch.LIBVCRUNTIME ref: 00073649
                                                                                                                                                                                                      • IsInExceptionSpec.LIBVCRUNTIME ref: 0007371B
                                                                                                                                                                                                      • _UnwindNestedFrames.LIBCMT ref: 0007379F
                                                                                                                                                                                                      • CallUnexpected.LIBVCRUNTIME ref: 000737BA
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 2123188842-393685449
                                                                                                                                                                                                      • Opcode ID: 6f61819c32306b36c622c45e9fe86d0d7c3b6fe6332645cc013d331ceb637ac9
                                                                                                                                                                                                      • Instruction ID: 9424d310b059b9433103ebcfa874ab0dd72964b60deccf5e715a4164620bab6b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f61819c32306b36c622c45e9fe86d0d7c3b6fe6332645cc013d331ceb637ac9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2B170B1C04209EFEF29DF94D8419AEBBB5FF04310B15C159E8086B212D739EB51EB99
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00071FA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 294 71fa0-71ff1 call 7d040 call 71f60 call 72497 301 71ff3-72005 294->301 302 7204d-72050 294->302 304 72070-72079 301->304 305 72007-7201e 301->305 303 72052-7205f call 72480 302->303 302->304 310 72064-7206d call 71f60 303->310 307 72034 305->307 308 72020-7202e call 72420 305->308 309 72037-7203c 307->309 315 72044-7204b 308->315 316 72030 308->316 309->305 312 7203e-72040 309->312 310->304 312->304 317 72042 312->317 315->310 319 72032 316->319 320 7207a-72083 316->320 317->310 319->309 321 72085-7208c 320->321 322 720bd-720cd call 72460 320->322 321->322 323 7208e-7209d call 7ce20 321->323 328 720e1-720fd call 71f60 call 72440 322->328 329 720cf-720de call 72480 322->329 331 7209f-720b7 323->331 332 720ba 323->332 329->328 331->332 332->322
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00071FD7
                                                                                                                                                                                                      • ___except_validate_context_record.LIBVCRUNTIME ref: 00071FDF
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 00072068
                                                                                                                                                                                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 00072093
                                                                                                                                                                                                      • _ValidateLocalCookies.LIBCMT ref: 000720E8
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 1170836740-1018135373
                                                                                                                                                                                                      • Opcode ID: 402d64ca9e48797299e9cd6dd5b2cafb74da6d6dfe3e30417a665345da7c75f0
                                                                                                                                                                                                      • Instruction ID: 6595f08cf70a4df1d640ea00dc8d78a01d626cc70e92c987d7394939081e39ed
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 402d64ca9e48797299e9cd6dd5b2cafb74da6d6dfe3e30417a665345da7c75f0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC41AC30E002089BCF10DF68C884A9EBBE5FF05314F14C195E9186B393C739A955CBA5
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 000724F1 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 340 724f1-724f8 341 724fd-72518 GetLastError call 727cc 340->341 342 724fa-724fc 340->342 345 72531-72533 341->345 346 7251a-7251c 341->346 347 72577-72582 SetLastError 345->347 346->347 348 7251e-7252f call 72807 346->348 348->345 351 72535-72545 call 754ce 348->351 354 72547-72557 call 72807 351->354 355 72559-72569 call 72807 351->355 354->355 360 7256b-7256d 354->360 361 7256f-72576 call 7540a 355->361 360->361 361->347
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,000724E8,0007231C,00071A34), ref: 000724FF
                                                                                                                                                                                                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0007250D
                                                                                                                                                                                                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00072526
                                                                                                                                                                                                      • SetLastError.KERNEL32(00000000,000724E8,0007231C,00071A34), ref: 00072578
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3852720340-0
                                                                                                                                                                                                      • Opcode ID: 0b82be340c3e320e07b577389569fe70c4d7feb6698d8366c07ad36466f7519c
                                                                                                                                                                                                      • Instruction ID: 35040baee969fffb7eb9a1cc485713b996f5cc72c90f98bc84a1cd98829afacc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b82be340c3e320e07b577389569fe70c4d7feb6698d8366c07ad36466f7519c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5012832D1AA125DB6642BB4BC956AB2F94EB00BB97308239F62C401E2EF7D4C41565C
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00072673 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 364 72673-7267d 365 726ee-726f1 364->365 366 726f3 365->366 367 7267f-7268c 365->367 370 726f5-726f9 366->370 368 72695-726b1 LoadLibraryExW 367->368 369 7268e-72691 367->369 373 726b3-726bc GetLastError 368->373 374 726fa-72700 368->374 371 72693 369->371 372 72709-7270b 369->372 376 726eb 371->376 372->370 377 726e6-726e9 373->377 378 726be-726d3 call 75708 373->378 374->372 375 72702-72703 FreeLibrary 374->375 375->372 376->365 377->376 378->377 381 726d5-726e4 LoadLibraryExW 378->381 381->374 381->377
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,?,00072734,?,?,00084C80,00000000,?,0007285F,00000004,InitializeCriticalSectionEx,0007ECBC,InitializeCriticalSectionEx,00000000), ref: 00072703
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FreeLibrary
                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                      • API String ID: 3664257935-2084034818
                                                                                                                                                                                                      • Opcode ID: 878372a814c2fe5972611118bbb96fe6a8e655a870c7e6d093190288777b8638
                                                                                                                                                                                                      • Instruction ID: ba980f68e4d1956d6d245e795007cf686ecec28a27349d22500ccb8de0ccccad
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 878372a814c2fe5972611118bbb96fe6a8e655a870c7e6d093190288777b8638
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 49119435E056219BEF724B68EC4075937E4AB09770F154251E91DFB280D67CED4086D9
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00074C74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D43B8AE7,?,?,00000000,0007D10F,000000FF,?,00074C47,00074D34,?,00074C1B,00000000), ref: 00074CA9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00074CBB
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(00000000,?,?,00000000,0007D10F,000000FF,?,00074C47,00074D34,?,00074C1B,00000000), ref: 00074CDD
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                      • Opcode ID: de03d04f58878d3490add69c4af08054db9732c79a736f81abfa7a1e80161c44
                                                                                                                                                                                                      • Instruction ID: 87ebcfaf1cc6ced8b610a8e68ba8c02f21e9a504cfe7adb4e374bfc33b20dcc9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: de03d04f58878d3490add69c4af08054db9732c79a736f81abfa7a1e80161c44
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8101F731E01659ABEB118F50CC05BAE7BF8FB08B10F004165E919A62D0D77C9840CB94
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00079720 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 000797A7
                                                                                                                                                                                                      • __alloca_probe_16.LIBCMT ref: 00079868
                                                                                                                                                                                                      • __freea.LIBCMT ref: 000798CF
                                                                                                                                                                                                        • Part of subcall function 000779A2: HeapAlloc.KERNEL32(00000000,00076B72,000788AA,?,00076B72,00000220,?,?,000788AA), ref: 000779D4
                                                                                                                                                                                                      • __freea.LIBCMT ref: 000798E4
                                                                                                                                                                                                      • __freea.LIBCMT ref: 000798F4
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __freea$__alloca_probe_16$AllocHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1096550386-0
                                                                                                                                                                                                      • Opcode ID: c9551ef5f44be87c7d2a5a9bb411a839c1034d971110eb33aed65cd532716ff7
                                                                                                                                                                                                      • Instruction ID: 74f76ebd114ff37b683f1cc4a881e7df8c32a46a2806c4e1aa7a0db9450ec729
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9551ef5f44be87c7d2a5a9bb411a839c1034d971110eb33aed65cd532716ff7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62519072E0020AABEB659EA4CC81EAB36E9EF45750B158129FD0CD6151EA78CC10D7A9
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00071000 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories,0007116C), ref: 0007100A
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 00071011
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                                      • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                                                                                                                                      • API String ID: 1646373207-2102062458
                                                                                                                                                                                                      • Opcode ID: 339103c29babc0600241b536e962b0c32d1d7761a8c4d50458e31114ff88cbb3
                                                                                                                                                                                                      • Instruction ID: f66817e16eafc326345ef2bbf7ba79a408b195628f8279d41490610f0e63e637
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 339103c29babc0600241b536e962b0c32d1d7761a8c4d50458e31114ff88cbb3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4EC01270B4278152EB2057B08D0F60D12886B497C5F0484D0660CEC0D0DDBCC4846567
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00079BEC Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetConsoleOutputCP.KERNEL32(D43B8AE7,?,00000000,?), ref: 00079C4F
                                                                                                                                                                                                        • Part of subcall function 0007708E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000798C5,?,00000000,-00000008), ref: 0007713A
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00079EAA
                                                                                                                                                                                                      • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00079EF2
                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00079F95
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2112829910-0
                                                                                                                                                                                                      • Opcode ID: 3ae3574b1b2f4b635bc1012ebe51cc74e5a8cb4a963d4154ca8b9517644acf1b
                                                                                                                                                                                                      • Instruction ID: ab5bf86cd7f51d8694b6ad547b77faa97981e7f228f22392bbc1768141da48eb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3ae3574b1b2f4b635bc1012ebe51cc74e5a8cb4a963d4154ca8b9517644acf1b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 44D16775D042489FCF15CFA8D884AEDBBF5FF09310F28852AE85AEB252D734A841CB54
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 000731C4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AdjustPointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1740715915-0
                                                                                                                                                                                                      • Opcode ID: f5e4fce2d81df4a497e59356d79775ff8b3e78bc085c06036607173d8a658826
                                                                                                                                                                                                      • Instruction ID: 49ee1fadea857fcccc622e6de030c6df4f064b429eac54c850f490457bcac9f9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f5e4fce2d81df4a497e59356d79775ff8b3e78bc085c06036607173d8a658826
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5751B372E05602AFFB258F50C841BAA77B4FF04310F14C52DE949561A3D739EA42EB98
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 0007B3A6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0007AB66,?,00000001,?,?,?,00079FE9,?,?,00000000), ref: 0007B3BD
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,0007AB66,?,00000001,?,?,?,00079FE9,?,?,00000000,?,?,?,0007A570,?), ref: 0007B3C9
                                                                                                                                                                                                        • Part of subcall function 0007B38F: CloseHandle.KERNEL32(FFFFFFFE,0007B3D9,?,0007AB66,?,00000001,?,?,?,00079FE9,?,?,00000000,?,?), ref: 0007B39F
                                                                                                                                                                                                      • ___initconout.LIBCMT ref: 0007B3D9
                                                                                                                                                                                                        • Part of subcall function 0007B351: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0007B380,0007AB53,?,?,00079FE9,?,?,00000000,?), ref: 0007B364
                                                                                                                                                                                                      • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0007AB66,?,00000001,?,?,?,00079FE9,?,?,00000000,?), ref: 0007B3EE
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2744216297-0
                                                                                                                                                                                                      • Opcode ID: 3d75a4e3d18c3a7df3152e6db8152fb3933eca7aa847834686a6ccea678fa41a
                                                                                                                                                                                                      • Instruction ID: 0176e7cec4d0e5fece96d7061e1b603e4a3f141de5ebf833221221756e8597b3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3d75a4e3d18c3a7df3152e6db8152fb3933eca7aa847834686a6ccea678fa41a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 01F0FE36801159BBDF222F91DC04A9E3F66FB09360B044050FA1C95120D73989E0DBE5
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 000737C5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 000737EA
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 0000000E.00000002.1843176741.0000000000071000.00000020.00000001.01000000.00000012.sdmp, Offset: 00070000, based on PE: true
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843024824.0000000000070000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843210137.000000000007E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843259719.0000000000084000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      • Associated: 0000000E.00000002.1843290499.0000000000086000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_14_2_70000_BraveUpdateOnDemand.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: EncodePointer
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 2118026453-2084237596
                                                                                                                                                                                                      • Opcode ID: 2b109f83713d39a0de02fcf4930425d65e8be3d04158a6d4a8e0700a25b23c99
                                                                                                                                                                                                      • Instruction ID: e6e37cf2ff0efd80aa9e283a7efa6360b06aee40a9528c6b25ca13868864e6ce
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2b109f83713d39a0de02fcf4930425d65e8be3d04158a6d4a8e0700a25b23c99
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 61418C71E00209AFEF56CF94CC81AEE7BB5FF08304F148059F90867251DB399A50EB96
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Callgraph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      • Opacity -> Relevance
                                                                                                                                                                                                      • Disassembly available
                                                                                                                                                                                                      callgraph 0 Function_00007FF6ECF53540 26 Function_00007FF6ECF53960 0->26 1 Function_00007FF6ECF510C0 6 Function_00007FF6ECF511C0 1->6 34 Function_00007FF6ECF53D70 1->34 2 Function_00007FF6ECF53E40 2->26 28 Function_00007FF6ECF539A0 2->28 3 Function_00007FF6ECF53040 23 Function_00007FF6ECF52F60 3->23 3->28 4 Function_00007FF6ECF54680 5 Function_00007FF6ECF52200 7 Function_00007FF6ECF51080 8 Function_00007FF6ECF51CC0 9 Function_00007FF6ECF51000 32 Function_00007FF6ECF532F0 9->32 10 Function_00007FF6ECF52100 10->2 12 Function_00007FF6ECF53C00 10->12 15 Function_00007FF6ECF53B00 10->15 19 Function_00007FF6ECF53BD0 10->19 10->26 33 Function_00007FF6ECF53930 10->33 11 Function_00007FF6ECF536C0 13 Function_00007FF6ECF53A00 14 Function_00007FF6ECF53C80 16 Function_00007FF6ECF51AD0 17 Function_00007FF6ECF51050 18 Function_00007FF6ECF538D0 20 Function_00007FF6ECF53B90 21 Function_00007FF6ECF51D90 22 Function_00007FF6ECF51E90 24 Function_00007FF6ECF53CE0 25 Function_00007FF6ECF53EE0 25->21 27 Function_00007FF6ECF51F60 25->27 29 Function_00007FF6ECF51EA0 25->29 36 Function_00007FF6ECF51DF0 25->36 40 Function_00007FF6ECF51DB0 25->40 30 Function_00007FF6ECF53D30 31 Function_00007FF6ECF53170 31->3 31->18 31->26 31->28 31->33 32->1 32->2 32->7 32->17 32->19 32->20 32->30 32->31 35 Function_00007FF6ECF52330 32->35 37 Function_00007FF6ECF51F70 32->37 38 Function_00007FF6ECF52030 32->38 42 Function_00007FF6ECF528F0 32->42 44 Function_00007FF6ECF52EB0 32->44 35->4 35->5 35->8 35->10 35->16 35->25 35->26 35->28 39 Function_00007FF6ECF51330 35->39 36->26 37->2 37->14 37->19 37->30 38->2 38->12 38->13 38->19 38->24 38->28 39->21 39->22 39->27 39->29 39->40 41 Function_00007FF6ECF51030 39->41 42->5 42->10 42->26 42->28 42->33 42->34 42->41 43 Function_00007FF6ECF52CF0 42->43 43->0 43->11 43->20 43->26 43->33 44->16 44->33

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00007FF6ECF51330 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 266memorylibraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 0 7ff6ecf51330-7ff6ecf51359 1 7ff6ecf5135f-7ff6ecf513a0 GetProcAddress * 3 0->1 2 7ff6ecf51691-7ff6ecf516c3 call 7ff6ecf51030 ExpandEnvironmentStringsW 0->2 4 7ff6ecf513a7-7ff6ecf513b1 1->4 8 7ff6ecf516c5-7ff6ecf516cc 2->8 9 7ff6ecf516ce-7ff6ecf516e4 LoadLibraryW 2->9 6 7ff6ecf513b7-7ff6ecf513bf 4->6 7 7ff6ecf51664-7ff6ecf5167d 4->7 6->7 10 7ff6ecf513c5-7ff6ecf513c8 6->10 11 7ff6ecf516eb-7ff6ecf516ee 8->11 9->11 10->7 12 7ff6ecf513ce-7ff6ecf513df lstrlenW 10->12 11->1 13 7ff6ecf516f4-7ff6ecf51718 ExpandEnvironmentStringsW 11->13 14 7ff6ecf513f1-7ff6ecf513f4 12->14 15 7ff6ecf513e1-7ff6ecf513e6 12->15 16 7ff6ecf5171a-7ff6ecf51721 13->16 17 7ff6ecf51723-7ff6ecf51739 LoadLibraryExW 13->17 19 7ff6ecf513fa-7ff6ecf51431 WideCharToMultiByte 14->19 20 7ff6ecf5163e-7ff6ecf51640 14->20 15->14 18 7ff6ecf513e8-7ff6ecf513ef 15->18 23 7ff6ecf51740-7ff6ecf51743 16->23 17->23 18->14 18->15 21 7ff6ecf51433-7ff6ecf51451 GetProcessHeap HeapAlloc 19->21 22 7ff6ecf51480-7ff6ecf514b1 WideCharToMultiByte 19->22 20->7 21->22 24 7ff6ecf51453-7ff6ecf5147d WideCharToMultiByte 21->24 25 7ff6ecf514b7-7ff6ecf514dd GetProcessHeap HeapAlloc 22->25 26 7ff6ecf51642-7ff6ecf51644 22->26 23->1 27 7ff6ecf51749-7ff6ecf5176d ExpandEnvironmentStringsW 23->27 24->22 25->26 28 7ff6ecf514e3-7ff6ecf5150f WideCharToMultiByte 25->28 29 7ff6ecf51649-7ff6ecf5164c 26->29 30 7ff6ecf51778-7ff6ecf5178e LoadLibraryExW 27->30 31 7ff6ecf5176f-7ff6ecf51776 27->31 33 7ff6ecf5151a-7ff6ecf5151d 28->33 34 7ff6ecf51511-7ff6ecf51514 28->34 29->7 35 7ff6ecf5164e-7ff6ecf51662 GetProcessHeap HeapFree 29->35 32 7ff6ecf51795-7ff6ecf51798 30->32 31->32 32->1 36 7ff6ecf5179e-7ff6ecf517a5 32->36 37 7ff6ecf51523-7ff6ecf51593 33->37 38 7ff6ecf51624 33->38 34->33 35->7 36->4 37->38 41 7ff6ecf51599-7ff6ecf515f3 call 7ff6ecf51d90 37->41 39 7ff6ecf51626-7ff6ecf5163c GetProcessHeap HeapFree 38->39 39->29 45 7ff6ecf515fc-7ff6ecf5160a 41->45 46 7ff6ecf5160c-7ff6ecf51614 call 7ff6ecf51f60 FlushFileBuffers 45->46 47 7ff6ecf5167e-7ff6ecf51685 call 7ff6ecf51e90 45->47 52 7ff6ecf5161a-7ff6ecf51622 call 7ff6ecf51db0 46->52 47->52 53 7ff6ecf51687-7ff6ecf5168f call 7ff6ecf51ea0 47->53 52->39 53->52
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Heap$ByteCharMultiProcessWide$AddressEnvironmentExpandLibraryLoadProcStrings$AllocFree$BuffersFileFlushlstrlen
                                                                                                                                                                                                      • String ID: %SYSTEMROOT%\system32\cabinet.dll$%WINDIR%\system32\cabinet.dll$C:\Windows\system32\cabinet.dll$FDICopy$FDICreate$FDIDestroy$MZx
                                                                                                                                                                                                      • API String ID: 3409977574-3837671842
                                                                                                                                                                                                      • Opcode ID: be8b20edd14dbf0bc7b8464e5ab653c9d39fe3ab5a57a864b2ff5d75a87a05d8
                                                                                                                                                                                                      • Instruction ID: c3f306850a09389fdc0f161a23c3dad15289de1fdbb1b5b36d873e9845e4c0cf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: be8b20edd14dbf0bc7b8464e5ab653c9d39fe3ab5a57a864b2ff5d75a87a05d8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CBC15223A1DA4281FA148B15A8543F567A2BF85791F44C235EB4DC36E0DF7EF945C30A
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF511C0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 105stringCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: lstrcmpi$ArgvCommandEnvironmentLineVariable
                                                                                                                                                                                                      • String ID: --chrome-beta$--chrome-dev$--chrome-frame$--chrome-sxs$--cleanup$--system-level$BraveSoftwareUpdateIsMachine${103BD053-949B-43A8-9120-2E424887DE11}${C6CB981E-DB30-4876-8639-109F8933582C}${CB2150F2-595F-4633-891A-E39720CE0531}
                                                                                                                                                                                                      • API String ID: 310715562-1446311126
                                                                                                                                                                                                      • Opcode ID: 53ad3257636432027177a422d5388deec34048ab42b9b14594bb3d1845c2475f
                                                                                                                                                                                                      • Instruction ID: 83db0ef92af2e5c47cf526cd2bfca4b1410b4bc5f59e8c38c77baa34924aa8bb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53ad3257636432027177a422d5388deec34048ab42b9b14594bb3d1845c2475f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EB416027A08A0A95EB10CB16E8443F967A5AF45BC5F54C032DB4DC73A0DE7EE945C30A
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF51AD0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 122fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Handle$File$CloseInformation$CreateErrorLast$Sleep
                                                                                                                                                                                                      • String ID: MZx
                                                                                                                                                                                                      • API String ID: 1461999944-2575928145
                                                                                                                                                                                                      • Opcode ID: fae700a5440509070e2741754b0b6822c2ebe808603f7c74cfe8dde0de059789
                                                                                                                                                                                                      • Instruction ID: 6eba3f65073c7887a7e390323e10e7e5d2edc7fe9afbf81e31ab514ccb7a281a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fae700a5440509070e2741754b0b6822c2ebe808603f7c74cfe8dde0de059789
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B941C123E0C54242F6658B2AA8047B62691BF857A8F54C230EF5D837E0EF3EAD46C705
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF510C0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 72COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Resource$CommandFindFreeLineLoadLocalLockSizeof
                                                                                                                                                                                                      • String ID: ChromeInstallerCleanup$MZx$Software\Microsoft\Windows\CurrentVersion\Uninstall\Brave${AFE6A462-C574-4B8A-AF43-4CC60DF4563B}
                                                                                                                                                                                                      • API String ID: 1366880580-2760568576
                                                                                                                                                                                                      • Opcode ID: eec448ab9775e991f69a745d0fca1f1602de0c784bc08e832daaece25ca3a26a
                                                                                                                                                                                                      • Instruction ID: ecc498918eba0e1d368e3e2f41b2f798563d78b59504634195739765820f5d26
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eec448ab9775e991f69a745d0fca1f1602de0c784bc08e832daaece25ca3a26a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4B213233A0A74285EE609B21A8043EA63A5AF45B91F45C135DB4E87B90DF7EF945C305
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF52330 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 339COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 112 7ff6ecf52330-7ff6ecf52375 call 7ff6ecf54680 call 7ff6ecf53960 117 7ff6ecf5237b-7ff6ecf52393 call 7ff6ecf539a0 112->117 118 7ff6ecf52469 112->118 117->118 122 7ff6ecf52399-7ff6ecf5241b call 7ff6ecf51cc0 117->122 120 7ff6ecf52470-7ff6ecf52486 118->120 125 7ff6ecf5242c-7ff6ecf52432 122->125 126 7ff6ecf5241d 122->126 125->126 128 7ff6ecf52434-7ff6ecf5244e call 7ff6ecf53960 125->128 127 7ff6ecf52421 126->127 129 7ff6ecf52427-7ff6ecf5242a 127->129 128->118 132 7ff6ecf52450-7ff6ecf52467 call 7ff6ecf539a0 128->132 129->120 132->118 135 7ff6ecf52487-7ff6ecf52496 call 7ff6ecf53ee0 132->135 138 7ff6ecf52498-7ff6ecf5249e GetLastError 135->138 139 7ff6ecf524a0-7ff6ecf524ae 135->139 138->127 140 7ff6ecf52586-7ff6ecf525bd call 7ff6ecf51cc0 139->140 141 7ff6ecf524b4-7ff6ecf524c6 call 7ff6ecf53960 139->141 147 7ff6ecf525ce-7ff6ecf525d4 140->147 148 7ff6ecf525bf 140->148 141->118 146 7ff6ecf524c8-7ff6ecf524df call 7ff6ecf539a0 141->146 146->118 154 7ff6ecf524e1-7ff6ecf524f0 call 7ff6ecf53ee0 146->154 147->148 151 7ff6ecf525d6-7ff6ecf525e8 call 7ff6ecf53960 147->151 150 7ff6ecf525c3-7ff6ecf525c9 148->150 150->129 151->118 157 7ff6ecf525ee-7ff6ecf52605 call 7ff6ecf539a0 151->157 161 7ff6ecf524f6-7ff6ecf5254d call 7ff6ecf52100 154->161 162 7ff6ecf52620-7ff6ecf52626 GetLastError 154->162 157->118 163 7ff6ecf5260b-7ff6ecf5261a call 7ff6ecf53ee0 157->163 167 7ff6ecf52553-7ff6ecf5255e 161->167 168 7ff6ecf5278e-7ff6ecf527a9 call 7ff6ecf539a0 161->168 162->150 163->162 172 7ff6ecf52727-7ff6ecf5274b call 7ff6ecf51330 call 7ff6ecf51ad0 163->172 170 7ff6ecf52628-7ff6ecf52632 167->170 171 7ff6ecf52564 167->171 183 7ff6ecf527ab-7ff6ecf527c7 call 7ff6ecf539a0 168->183 184 7ff6ecf52780-7ff6ecf52789 168->184 176 7ff6ecf5263c-7ff6ecf52640 170->176 175 7ff6ecf52568-7ff6ecf5256e 171->175 193 7ff6ecf52750-7ff6ecf5275d 172->193 179 7ff6ecf52574-7ff6ecf5257c 175->179 180 7ff6ecf5268f-7ff6ecf52692 175->180 181 7ff6ecf52642-7ff6ecf52649 176->181 182 7ff6ecf52634-7ff6ecf52638 176->182 179->175 188 7ff6ecf5257e-7ff6ecf52581 179->188 185 7ff6ecf52694-7ff6ecf526cd call 7ff6ecf52200 180->185 186 7ff6ecf526d1-7ff6ecf526f3 call 7ff6ecf51ad0 180->186 181->182 189 7ff6ecf5264b-7ff6ecf5264e 181->189 182->176 183->184 196 7ff6ecf527c9-7ff6ecf527e4 call 7ff6ecf539a0 183->196 185->186 207 7ff6ecf526f7-7ff6ecf526fa 186->207 208 7ff6ecf526f5 186->208 188->189 189->180 195 7ff6ecf52650-7ff6ecf52656 189->195 198 7ff6ecf5275f 193->198 199 7ff6ecf52761-7ff6ecf52768 193->199 201 7ff6ecf5267a-7ff6ecf5268a call 7ff6ecf539a0 195->201 202 7ff6ecf52658-7ff6ecf5265b 195->202 196->184 215 7ff6ecf527e6-7ff6ecf52801 call 7ff6ecf539a0 196->215 198->199 205 7ff6ecf5276a-7ff6ecf5277e call 7ff6ecf53960 199->205 206 7ff6ecf5270b-7ff6ecf5270e 199->206 201->180 202->201 209 7ff6ecf5265d-7ff6ecf52678 call 7ff6ecf539a0 202->209 205->206 206->120 212 7ff6ecf526fc 207->212 213 7ff6ecf52713-7ff6ecf52725 call 7ff6ecf53960 207->213 208->207 209->180 209->201 217 7ff6ecf52701-7ff6ecf52708 212->217 213->217 215->184 223 7ff6ecf52807-7ff6ecf52822 call 7ff6ecf539a0 215->223 217->206 223->184 226 7ff6ecf52828-7ff6ecf5283f call 7ff6ecf539a0 223->226 226->184 229 7ff6ecf52845-7ff6ecf52860 call 7ff6ecf539a0 226->229 229->184 232 7ff6ecf52866-7ff6ecf52881 call 7ff6ecf539a0 229->232 232->184 235 7ff6ecf52887-7ff6ecf528a2 call 7ff6ecf539a0 232->235 235->184 238 7ff6ecf528a8-7ff6ecf528c1 call 7ff6ecf539a0 235->238 238->184 241 7ff6ecf528c7-7ff6ecf528e5 call 7ff6ecf539a0 238->241 241->167 244 7ff6ecf528eb 241->244 244->184
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,MZx,?,?,?,?,?,00007FF6ECF53447), ref: 00007FF6ECF52498
                                                                                                                                                                                                        • Part of subcall function 00007FF6ECF51CC0: EnumResourceNamesW.KERNEL32 ref: 00007FF6ECF51CD7
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00000000,MZx,?,?,?,?,?,00007FF6ECF53447), ref: 00007FF6ECF52620
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLast$EnumNamesResource
                                                                                                                                                                                                      • String ID: " --$MZx$new-setup-exe$setup.exe$update-setup-exe$x$y
                                                                                                                                                                                                      • API String ID: 737610517-3588629935
                                                                                                                                                                                                      • Opcode ID: a8a5adab8218939cd3ad64d718a65743d1ab3640c79cf4c247dbf45c9200ddad
                                                                                                                                                                                                      • Instruction ID: 4f88729ec3a955da5debae5cb22dc3d03c6fffb0711370d3d7a77634366f2da4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a8a5adab8218939cd3ad64d718a65743d1ab3640c79cf4c247dbf45c9200ddad
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6E171B760C68281EA60CB54E1443F96361EF45784F908232DB8D977D6DF3EE94AC70A
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53170 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectoryErrorFreeFunction036LastLocalSystem
                                                                                                                                                                                                      • String ID: .tmp$CR_$MZx
                                                                                                                                                                                                      • API String ID: 1732257400-2866166633
                                                                                                                                                                                                      • Opcode ID: 718a5a7b2bd421c5ee3395f2823bb4f15cc6c72c6dfe0933d8db1a6e6d74d35e
                                                                                                                                                                                                      • Instruction ID: f38069407b8142136ecdd1e96c78034af4d2ad0ea4b21ce39cc9deee0e1410b0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 718a5a7b2bd421c5ee3395f2823bb4f15cc6c72c6dfe0933d8db1a6e6d74d35e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D23184A3B1C64252FA109B15A9407F96752AF46BC0F54C131DF8E87781DE3EE989C30A
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF52200 Relevance: 12.1, APIs: 8, Instructions: 78processsynchronizationCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseErrorHandleLastProcess$AttributesCodeCreateExitFileObjectSingleWait
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1236864362-0
                                                                                                                                                                                                      • Opcode ID: 7bcea0aa7e1654ef5787a63bae3990c0f6ce7ce81792a7877ab6c3b4acd2fa63
                                                                                                                                                                                                      • Instruction ID: de536d24a71d70c6e15b1e3fea313250dacd05990586433b6b4a7f1383b76bbb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7bcea0aa7e1654ef5787a63bae3990c0f6ce7ce81792a7877ab6c3b4acd2fa63
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2315233518A8186E7208F59F8447A9B7A1FF88755F048234DB8983754EF3DE885CB41
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF52F60 Relevance: 12.1, APIs: 8, Instructions: 63memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Token$InformationLocalProcess$AllocCloseCurrentErrorFreeHandleLastOpen
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3439255530-0
                                                                                                                                                                                                      • Opcode ID: f30d9c696816cdab1ec3a17349200a718af0a1d3f92af8fe297077335a5cac70
                                                                                                                                                                                                      • Instruction ID: aa3d7d5eff9cede7a51ca33ce72ddd9e80412ce8faf7e5e3da31ff95ad69a404
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f30d9c696816cdab1ec3a17349200a718af0a1d3f92af8fe297077335a5cac70
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C21212370CA4282F6609B65B818BAA63A0AFC4B45F548131EF4E97B54DE3EDC46CB05
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF532F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Resource$Process$CommandCurrentErrorFileFindFreeLastLineLoadLocalLockModuleNameSizeSizeofWorking
                                                                                                                                                                                                      • String ID: InstallerExtraCode1
                                                                                                                                                                                                      • API String ID: 737911292-2381712892
                                                                                                                                                                                                      • Opcode ID: 01f12ac26f3242a4fc467eb081aa636f9ead95efcf205e273a6c2562b67878dd
                                                                                                                                                                                                      • Instruction ID: 51856559129665c2d23ec7fd05e8eaca3d8c24bdac99d6d87bc3b69155d90bf8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 01f12ac26f3242a4fc467eb081aa636f9ead95efcf205e273a6c2562b67878dd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1651932361CA8281EB109F65E5443EEA3A0EF80B90F548131EB9D83BD9DF7DD549CB09
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      • D:PAI(A;;FA;;;BA)(A;OIIOCI;GA;;;BA)(A;;FA;;;SY)(A;OIIOCI;GA;;;SY)(A;OIIOCI;GA;;;CO)(A;;FA;;;, xrefs: 00007FF6ECF530E9
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: InformationProcessTokenVolume$CloseCurrentErrorFreeHandleLastLocalNameOpenPath
                                                                                                                                                                                                      • String ID: D:PAI(A;;FA;;;BA)(A;OIIOCI;GA;;;BA)(A;;FA;;;SY)(A;OIIOCI;GA;;;SY)(A;OIIOCI;GA;;;CO)(A;;FA;;;
                                                                                                                                                                                                      • API String ID: 3974508999-3878039831
                                                                                                                                                                                                      • Opcode ID: 5c11e7c16573a4bb4193614ac1268811fa8dea902af8f6831b8809c4acb0594e
                                                                                                                                                                                                      • Instruction ID: 42b80325cb9f4f0351b671a1010827c9fc37a62298f8bea0844438bcca40283e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c11e7c16573a4bb4193614ac1268811fa8dea902af8f6831b8809c4acb0594e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5317F73A1868282E7508B24E8043EA6361EF96744F658131DB8DC7BD4DF3FD90AC70A
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53EE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLast$CloseCreateHandleWrite
                                                                                                                                                                                                      • String ID: MZx
                                                                                                                                                                                                      • API String ID: 4031202350-2575928145
                                                                                                                                                                                                      • Opcode ID: 4da60d2dbd631154f2cac231304a75b257b9f6fb2b7775f02018daf60bcdbad8
                                                                                                                                                                                                      • Instruction ID: b976008f1fd70831cb6343a4be96423edd6977805dc91a3b1c06907499ca9680
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4da60d2dbd631154f2cac231304a75b257b9f6fb2b7775f02018daf60bcdbad8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1721C623B1845152EE159F12A9147FAA351BF48BC8F888131FF4E87785DE3EE90AC746
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53E40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpen
                                                                                                                                                                                                      • String ID: MZx$Software\BraveSoftware\Update\ClientState\
                                                                                                                                                                                                      • API String ID: 47109696-1006479344
                                                                                                                                                                                                      • Opcode ID: 0bf115a699aec88be2570a626c41529b181763eb6068d79b65174ffdd59f7d96
                                                                                                                                                                                                      • Instruction ID: c2cd29e30d01d4ad2b0405484cd2d0b240728f78f24dc76dc260d5b343f667b4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0bf115a699aec88be2570a626c41529b181763eb6068d79b65174ffdd59f7d96
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F401DE67B1965142EB62CBA5E8443EA2792AF44B80F448131EF5D87B81EE3ED84DC346
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53CE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registrystringCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 490 7ff6ecf53ce0-7ff6ecf53d26 lstrlenW RegSetValueExW
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Valuelstrlen
                                                                                                                                                                                                      • String ID: MZx
                                                                                                                                                                                                      • API String ID: 799288031-2575928145
                                                                                                                                                                                                      • Opcode ID: eef66df1a55e0406f6d32addfd628c4762235853b8982a6a9ae0fcce0f669e5e
                                                                                                                                                                                                      • Instruction ID: 4c1ea7a8542b07c6818db27455d74224f309dbe32390a0384327ced56256a050
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eef66df1a55e0406f6d32addfd628c4762235853b8982a6a9ae0fcce0f669e5e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BE0D83671455085E7119B2AF808B996660AB9CFD5F048030DE4C43B64CE3DC546C700
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53D70 Relevance: 4.6, APIs: 3, Instructions: 60registryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 491 7ff6ecf53d70-7ff6ecf53da3 RegOpenKeyExW 492 7ff6ecf53da5-7ff6ecf53dad 491->492 493 7ff6ecf53dc1-7ff6ecf53dff RegQueryValueExW 491->493 494 7ff6ecf53db5-7ff6ecf53dc0 492->494 495 7ff6ecf53daf RegCloseKey 492->495 493->492 496 7ff6ecf53e01-7ff6ecf53e06 493->496 495->494 496->492 497 7ff6ecf53e08-7ff6ecf53e10 496->497 498 7ff6ecf53e29 497->498 499 7ff6ecf53e12-7ff6ecf53e1d 497->499 500 7ff6ecf53e2e-7ff6ecf53e31 498->500 499->500 501 7ff6ecf53e1f-7ff6ecf53e24 499->501 500->492 502 7ff6ecf53e36-7ff6ecf53e38 501->502 503 7ff6ecf53e26 501->503 502->492 503->498
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseOpenQueryValue
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3677997916-0
                                                                                                                                                                                                      • Opcode ID: 913576f29219455dba437064464af603eabe837be3e84081c1b97da231c73675
                                                                                                                                                                                                      • Instruction ID: 777f7632d581468a987cf94b743e41c29092a44ebb78ac3e174ced62697d9f7f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 913576f29219455dba437064464af603eabe837be3e84081c1b97da231c73675
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F0218E3771864586EB608F29E8047AAA3B5FF84780F448131EB8D83B94DE7ED849CB05
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RegQueryValueExW.KERNELBASE(?,?,?,?,MZx,?,00007FF6ECF520A6), ref: 00007FF6ECF53C33
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: QueryValue
                                                                                                                                                                                                      • String ID: MZx
                                                                                                                                                                                                      • API String ID: 3660427363-2575928145
                                                                                                                                                                                                      • Opcode ID: a70c7a76e5b8b6159f66a07447bfa7b2e76dbbbc6b5d8d2c4ce7cb94b1699c6c
                                                                                                                                                                                                      • Instruction ID: 0b5a589c86096eac8b64f7f8ebfc0bda30c3621e094cca0d594fbe20064499bd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a70c7a76e5b8b6159f66a07447bfa7b2e76dbbbc6b5d8d2c4ce7cb94b1699c6c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B01D433A5854582E7608B28E1097AA73E0EF80754F44C135EB4A83BD4DF3DD849CA05
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF51000 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExitProcess
                                                                                                                                                                                                      • String ID: MZx
                                                                                                                                                                                                      • API String ID: 621844428-2575928145
                                                                                                                                                                                                      • Opcode ID: 0a848b0dd2127952284119b96377679ac836529e121bac861a9036ada258ffa9
                                                                                                                                                                                                      • Instruction ID: 4c64cd557537e1f498cd90c62e06fb777933a882a63a67edf02ae000664442e1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a848b0dd2127952284119b96377679ac836529e121bac861a9036ada258ffa9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4CC01226A1855283E614DB24D4151E96320AF40744F40C031C75D433298E3DA907C74A
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF51DF0 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateFileHandle
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3498533004-0
                                                                                                                                                                                                      • Opcode ID: a0da7f0cbcb8518973dac9d7c586c98ea94a7ca5d87cc395a8b497b6c15ab702
                                                                                                                                                                                                      • Instruction ID: e77e9ef35ee04bb0a39d7a5d85a9c9a676f51807b93470b905b53ef25ff23b6a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0da7f0cbcb8518973dac9d7c586c98ea94a7ca5d87cc395a8b497b6c15ab702
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E601447261464142E6608B25E8583E52651AF457F4F14C330EBB947BD0DFBEA886C705
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF51DB0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FindCloseChangeNotification.KERNELBASE(?,?,00000000,00007FF6ECF53FBF), ref: 00007FF6ECF51DD0
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ChangeCloseFindNotification
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2591292051-0
                                                                                                                                                                                                      • Opcode ID: 5e4e4560b8218055e5cd9b848970796ffe5649c193789c5f537aee99201477c3
                                                                                                                                                                                                      • Instruction ID: c85ed3abbb8f9b167d74dcecd6626ef1eb40c7bfd58a76c4fb60ba1f574b1e13
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5e4e4560b8218055e5cd9b848970796ffe5649c193789c5f537aee99201477c3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8D09E3390495581D6645B65B4882E42220AF55735F559330E7BD462E09FB968D38345
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                      Function 00007FF6ECF53D30 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000031.00000002.2317964710.00007FF6ECF51000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF6ECF50000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000031.00000002.2317902412.00007FF6ECF50000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318002934.00007FF6ECF55000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318043414.00007FF6ECF58000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ECF5A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000031.00000002.2318144175.00007FF6ED95A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_49_2_7ff6ecf50000_brave_installer-x64.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                      • Opcode ID: 8d47ce4adae051e16bff91fc4dcb9f69c1f9e74ce06b048ac4fc986741e11445
                                                                                                                                                                                                      • Instruction ID: e65b0966fda4d0e7568aa41b7d6029690b1fb26d0841c95a479aabb766e3375c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8d47ce4adae051e16bff91fc4dcb9f69c1f9e74ce06b048ac4fc986741e11445
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6D05E76614A8086D3609F14E84570D3760F788B84F909010EB4C03B20CF3DC215CF04
                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                      Uniqueness Score: -1.00%