Edit tour

Windows Analysis Report
BrowserUpdate.exe

Overview

General Information

Sample name:	BrowserUpdate.exe
Analysis ID:	1472046
MD5:	696b3679926998b45c806a1068ffcb75
SHA1:	87a680e3018d3604eea9b1d28915fac5172f30df
SHA256:	393b1fdda7c4af084743c56c27585366567a8446c6438753d20b0b9ee3e72541
Infos:

Detection

MicroClip

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected MicroClip

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

Installs a raw input device (often for capturing keystrokes)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

Process Tree

System is w10x64

BrowserUpdate.exe (PID: 1220 cmdline: "C:\Users\user\Desktop\BrowserUpdate.exe" MD5: 696B3679926998B45C806A1068FFCB75)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
BrowserUpdate.exe	JoeSecurity_MicroClip	Yara detected MicroClip	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2205746713.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MicroClip	Yara detected MicroClip	Joe Security
00000000.00000000.2108717389.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MicroClip	Yara detected MicroClip	Joe Security
Process Memory Space: BrowserUpdate.exe PID: 1220	JoeSecurity_MicroClip	Yara detected MicroClip	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: BrowserUpdate.exe

Static PE information: certificate valid

Source:	Binary string: MpGear.pdb source: BrowserUpdate.exe
Source:	Binary string: BTR.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: KSLDriver.pdb source: BrowserUpdate.exe
Source:	Binary string: KSLD.pdb source: BrowserUpdate.exe
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: BrowserUpdate.exe
Source:	Binary string: offreg.pdbH source: BrowserUpdate.exe
Source:	Binary string: KSLDriver.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: MsMpEngCP.pdb source: BrowserUpdate.exe
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: BrowserUpdate.exe, 00000000.00000002.2226332115.00007FF7E53C8000.00000080.00000001.01000000.00000003.sdmp, BrowserUpdate.exe, 00000000.00000000.2111947960.00007FF7E5386000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb0 source: BrowserUpdate.exe
Source:	Binary string: BTR.pdb source: BrowserUpdate.exe
Source:	Binary string: MsMpEngSvc.pdb source: BrowserUpdate.exe
Source:	Binary string: mpengine.pdb source: BrowserUpdate.exe
Source:	Binary string: MsMpEngSvc.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: offreg.pdb source: BrowserUpdate.exe
Source:	Binary string: KSLD.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: MsMpEngCP.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: BrowserUpdate.exe, 00000000.00000002.2226332115.00007FF7E53C8000.00000080.00000001.01000000.00000003.sdmp, BrowserUpdate.exe, 00000000.00000000.2111947960.00007FF7E5386000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: MpGear.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: mpengine.pdbOGPS source: BrowserUpdate.exe

Source: unknown

DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.110
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.110
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.110
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: BrowserUpdate.exe	String found in binary or memory: http://.css
Source: BrowserUpdate.exe	String found in binary or memory: http://.jpg
Source: BrowserUpdate.exe	String found in binary or memory: http://.ocx.cabhtml:file::LowTelemetry
Source: BrowserUpdate.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: BrowserUpdate.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: BrowserUpdate.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: BrowserUpdate.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: BrowserUpdate.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BrowserUpdate.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: BrowserUpdate.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: BrowserUpdate.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: BrowserUpdate.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: BrowserUpdate.exe	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest
Source: BrowserUpdate.exe	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: BrowserUpdate.exe	String found in binary or memory: http://earth.google.com/kml/2.0
Source: BrowserUpdate.exe	String found in binary or memory: http://earth.google.com/kml/2.1
Source: BrowserUpdate.exe	String found in binary or memory: http://earth.google.com/kml/2.2
Source: BrowserUpdate.exe	String found in binary or memory: http://html4/loose.dtd
Source: BrowserUpdate.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: BrowserUpdate.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: BrowserUpdate.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: BrowserUpdate.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: BrowserUpdate.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: BrowserUpdate.exe	String found in binary or memory: http://support.google.com/installer/
Source: BrowserUpdate.exe	String found in binary or memory: http://support.google.com/installer/%s?product=%s&error=%d
Source: BrowserUpdate.exe	String found in binary or memory: http://wails.localhost/runtime.WindowReload();msSmartScreenProtection-//ietf//dtd
Source: BrowserUpdate.exe	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema
Source: BrowserUpdate.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: BrowserUpdate.exe	String found in binary or memory: http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2
Source: BrowserUpdate.exe	String found in binary or memory: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web
Source: BrowserUpdate.exe	String found in binary or memory: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=webreferrerEvalError
Source: BrowserUpdate.exe	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtdWarning:
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengis.net/gml
Source: BrowserUpdate.exe	String found in binary or memory: http://www.opengis.net/gml/3.2
Source: BrowserUpdate.exe	String found in binary or memory: http://www.opengis.net/gml/3.3/exr
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.opengis.net/kml/2.2
Source: BrowserUpdate.exe	String found in binary or memory: http://www.topografix.com/GPX/1/1
Source: BrowserUpdate.exe	String found in binary or memory: https://clients2.google.com/cr/report
Source: BrowserUpdate.exe	String found in binary or memory: https://crashpad.chromium.org/
Source: BrowserUpdate.exe	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: BrowserUpdate.exe	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: BrowserUpdate.exe	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: BrowserUpdate.exe	String found in binary or memory: https://github.com/gin-gonic/gin/blob/master/docs/doc.md#dont-trust-all-proxies
Source: BrowserUpdate.exe	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: BrowserUpdate.exe	String found in binary or memory: https://pkg.go.dev/github.com/gin-gonic/gin#readme-don-t-trust-all-proxies
Source: BrowserUpdate.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflict%s%sthis%s
Source: BrowserUpdate.exe	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: BrowserUpdate.exe	String found in binary or memory: https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.goo
Source: BrowserUpdate.exe	String found in binary or memory: https://www.apple.com/appleca/0

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: GetRawInputData

memstr_b291d2fe-0

Source: BrowserUpdate.exe	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: BrowserUpdate.exe	Static PE information: Resource name: BINARY type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Source: BrowserUpdate.exe	Static PE information: Resource name: BINARY type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Source: BrowserUpdate.exe	Static PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: BrowserUpdate.exe	Static PE information: Resource name: RT_STRING type: PDP-11 executable not stripped
Source: BrowserUpdate.exe	Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped

Source: BrowserUpdate.exe

Static PE information: Number of sections : 17 > 10

Source: BrowserUpdate.exe, 00000000.00000000.2109357931.00007FF7E4903000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMsMpEngCP.exeZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E3897000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameupdater.exeH vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: GetOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SetOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: ENG:OFNSET:SetOriginalFileNameProcess:process:// vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameCreatorProcessId<Process ProcessId="%u" ProcessCreationTime="%llu" CreatorProcessId="%u" CreatorProcessCreationTime="%llu" Name="%s" IsExcluded="%u" IsFriendly="%u"> vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SecondParameterBM_RegistryKeyDeleteBM_RegistryKeyRenameBM_RegistryDeleteValueBM_RegistrySetValueBM_OpenFileBM_DeleteFileBM_RegistryKeyCreateBM_FileMetaDataBM_ProcessCreateBM_RawWriteBM_NetworkDetectionBM_ProcessStartBM_NetworkDataSendBM_NetworkConnectBM_RemoteThreadCreateBM_BootSectorChangeBM_Etw_PsSetLoadImageNotifyRoutineBM_EngineInternalBM_Etw_SetEventHookBM_Etw_TerminateProcessBM_ModuleLoadBM_ArDetectionBM_RegistryBlockDeleteBM_RegistryBlockSetBM_Etw_OpenThreadBM_Etw_OpenProcessBM_Etw_RegisterShutdownBM_Etw_RegisterLastShutdownBM_Etw_NtAdjustPrivilegesBM_Etw_RegisterInputDevicesBM_Etw_WriteMemoryBM_Etw_SetThreadContextBM_RegistryBlockReplaceBM_RegistryBlockRestoreBM_DesktopBM_VolumeMountBM_RegistryRestoreBM_Etw_CreateLinkBM_RegistryBlockRenameBM_RegistryReplaceBM_Etw_SetWindowsHookBM_Etw_BlockExploitBM_CreateFolderBM_Etw_GetAsyncKeyStateBM_BlockOpenProcessBM_OpenProcessBM_Etw_CodeInjectionBM_RegistryBlockCreateBM_EnumFolderBM_Etw_WMIExecMethodBM_Etw_OCTAGON_PROCESS_TOKEN_TAMPERING_ENFORCEBM_RenameFolderBM_Etw_DirEnumBM_Etw_AllocVmLocalBM_Etw_WMIActivityNewBM_Etw_ClearLogBM_Etw_OCTAGON_DANGEROUS_DEVICE_PRESENT_AUDITBM_Etw_OCTAGON_DRIVER_DISPATCH_REDIRECTION_AUDITBM_HardLinkFileBM_Etw_OCTAGON_RUNTIME_CI_FAILURE_AUDITBM_Etw_OCTAGON_DANGEROUS_DEVICE_PRESENT_ENFORCEBM_Etw_OCTAGON_DRIVER_DISPATCH_REDIRECTION_ENFORCEBM_Etw_OCTAGON_PROCESS_TOKEN_TAMPERING_AUDITBM_Etw_OCTAGON_RUNTIME_CI_FAILURE_ENFORCEBM_Etw_CredEnumerateBM_Etw_CredReadCredentialsBM_Etw_CredFindBestCredentialBM_Etw_CredReadDomainCredentialsBM_DLPBM_CopyFileBM_Etw_OCTAGON_PROCESS_TAMPERING_AUDITBM_Etw_OCTAGON_PROCESS_TAMPERING_ENFORCEBM_TaintBM_Etw_VaultGetUniqueCredentialBM_Amsi_MatchBM_Amsi_ScanBM_Etw_CredBackupCredentialsBM_Etw_CredReadByTokenHandleBM_Etw_VaultEnumerateCredentialsBM_Etw_VaultFindCredentialsBM_Etw_LogonFailureBM_Etw_LogonSuccessBM_Etw_AccountPasswordChangedBM_Etw_UserAccountChangedBM_Etw_BITSCreateBM_Etw_LDAPSearchBM_Etw_ScheduledTaskUpdateBM_Etw_ScheduledTaskCreateBM_Etw_ExploitProtectionBM_Etw_UserAccountCreatedBM_Network_VolumeBM_Network_PortOpenBM_Etw_HiveHistoryClearBM_Etw_AccountPasswordResetBM_SignatureTriggerBM_OriginalFileNameBM_Etw_UnloadDriverBM_Etw_LoadDriverBM_Etw_UnloadDeviceBM_Etw_LoadDeviceBM_Etw_ResumeThreadBM_Etw_SuspendThreadBM_Etw_ResumeProcessBM_Etw_SuspendProcessBM_Etw_ServiceHostStartedBM_Etw_ServiceChangeAccountInfoBM_Network_FailureBM_Etw_ServiceStartedBM_Etw_ServiceStopBM_Etw_ProtectVmLocalBM_Etw_ServiceChangeBinaryPathBM_Etw_ServiceChangeStartTypeAL""L"%ls""%hS"BM_Etw_AllocVmRemoteBM_Etw_ProtectVmRemoteBM_Etw_V2CodeInjectionBM_Etw_ReadVmRemoteATTR_%08lxSigSeqThreatName{0, %ls, __attr_none__, %ls, %ls}0x%lXError while processing Event, i.e you're missing an event.Error while processing Event: ID = [%d], HR = [%lx]IsPePlusIsPeFileInfoIsPacked vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCompanyNameCommentsLegalCopyrightProductNameFileDescriptionLegalTrademarksPeStaticCRC3LengthCRC1IatSkipCRC3CRC2CopyrightCommentsArchitectureTrademarksFileVersionPeStaticsEpSecSectionKCRC2KCRC1KCRC3InternalNameFileDescriptionOriginalFileNamePEUnknownx86ia64x64 vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000000.2109357931.00007FF7E4906000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMsMpEngSvc.dllZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000000.2109357931.00007FF7E4906000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamempengine.dllZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000000.2109357931.00007FF7E4906000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMpGear.dllZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \Unknown member: doshdr.%spevars not availableUnknown member: pehdr.%sInvalid index in DataDirectory: %dInvalid index in opclog: %dInvalid index in fopclog2: %dInvalid index in epcode: %dInvalid index in fopclog: %dUnknown member: peattributes.%sInvalid section %d or bigger than NumberOfSection=%d!__mmap_ex() failedpe_fofs_to_mofs failed!__mmap_ex(%d) failedmmap_patch(): buffer is emptymmap_patch_buff() failedpe_mofs_to_fofs(%d) failedUfsSeekRead(%d) failedImageName is NULLStringCchCopyA failedFileDescriptionInternalNameCompanyNamepe.get_versioninfo() failed to create the StringVersionIterator: %sInvalid sigattr_head indexpe.vm_search: mask_size != buffer_sizeInvalid index in netmetadata.tokens: %dpe.get_fixedversioninfo() failed to create the StringVersionIterator: %sFileVersionFileTypeFileSubtypeFileDateOriginalFilenameProductVersionFileFlagsMaskFileFlagsFileOSpe.metadata_decode: decode failed for 0x%xInvalid index in v->imps: %dfnrvape.metadata_decode: Invalid field index %d (should be 1-based)9m vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: ClearOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: $OFNAllowIdenticalNamesClearOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: mZOriginalFileNameMaintenanceWindow vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: mZOriginalFileNameMaintenanceWindowprocessed%zd files in Moac, %zd skipped (cached), %zd filename setOriginalFileName Maintenance:HintENG:OFNPROCESSED:) vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .?AVCMaintenanceOriginalFileNameTask@@ vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBTR.sysZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameoffreg.dllj% vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKSLDriver.sysZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKSLD.sysZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameupdater.exeH vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: GetOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: SetOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: ENG:OFNSET:SetOriginalFileNameProcess:process:// vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFileNameCreatorProcessId<Process ProcessId="%u" ProcessCreationTime="%llu" CreatorProcessId="%u" CreatorProcessCreationTime="%llu" Name="%s" IsExcluded="%u" IsFriendly="%u"> vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: SecondParameterBM_RegistryKeyDeleteBM_RegistryKeyRenameBM_RegistryDeleteValueBM_RegistrySetValueBM_OpenFileBM_DeleteFileBM_RegistryKeyCreateBM_FileMetaDataBM_ProcessCreateBM_RawWriteBM_NetworkDetectionBM_ProcessStartBM_NetworkDataSendBM_NetworkConnectBM_RemoteThreadCreateBM_BootSectorChangeBM_Etw_PsSetLoadImageNotifyRoutineBM_EngineInternalBM_Etw_SetEventHookBM_Etw_TerminateProcessBM_ModuleLoadBM_ArDetectionBM_RegistryBlockDeleteBM_RegistryBlockSetBM_Etw_OpenThreadBM_Etw_OpenProcessBM_Etw_RegisterShutdownBM_Etw_RegisterLastShutdownBM_Etw_NtAdjustPrivilegesBM_Etw_RegisterInputDevicesBM_Etw_WriteMemoryBM_Etw_SetThreadContextBM_RegistryBlockReplaceBM_RegistryBlockRestoreBM_DesktopBM_VolumeMountBM_RegistryRestoreBM_Etw_CreateLinkBM_RegistryBlockRenameBM_RegistryReplaceBM_Etw_SetWindowsHookBM_Etw_BlockExploitBM_CreateFolderBM_Etw_GetAsyncKeyStateBM_BlockOpenProcessBM_OpenProcessBM_Etw_CodeInjectionBM_RegistryBlockCreateBM_EnumFolderBM_Etw_WMIExecMethodBM_Etw_OCTAGON_PROCESS_TOKEN_TAMPERING_ENFORCEBM_RenameFolderBM_Etw_DirEnumBM_Etw_AllocVmLocalBM_Etw_WMIActivityNewBM_Etw_ClearLogBM_Etw_OCTAGON_DANGEROUS_DEVICE_PRESENT_AUDITBM_Etw_OCTAGON_DRIVER_DISPATCH_REDIRECTION_AUDITBM_HardLinkFileBM_Etw_OCTAGON_RUNTIME_CI_FAILURE_AUDITBM_Etw_OCTAGON_DANGEROUS_DEVICE_PRESENT_ENFORCEBM_Etw_OCTAGON_DRIVER_DISPATCH_REDIRECTION_ENFORCEBM_Etw_OCTAGON_PROCESS_TOKEN_TAMPERING_AUDITBM_Etw_OCTAGON_RUNTIME_CI_FAILURE_ENFORCEBM_Etw_CredEnumerateBM_Etw_CredReadCredentialsBM_Etw_CredFindBestCredentialBM_Etw_CredReadDomainCredentialsBM_DLPBM_CopyFileBM_Etw_OCTAGON_PROCESS_TAMPERING_AUDITBM_Etw_OCTAGON_PROCESS_TAMPERING_ENFORCEBM_TaintBM_Etw_VaultGetUniqueCredentialBM_Amsi_MatchBM_Amsi_ScanBM_Etw_CredBackupCredentialsBM_Etw_CredReadByTokenHandleBM_Etw_VaultEnumerateCredentialsBM_Etw_VaultFindCredentialsBM_Etw_LogonFailureBM_Etw_LogonSuccessBM_Etw_AccountPasswordChangedBM_Etw_UserAccountChangedBM_Etw_BITSCreateBM_Etw_LDAPSearchBM_Etw_ScheduledTaskUpdateBM_Etw_ScheduledTaskCreateBM_Etw_ExploitProtectionBM_Etw_UserAccountCreatedBM_Network_VolumeBM_Network_PortOpenBM_Etw_HiveHistoryClearBM_Etw_AccountPasswordResetBM_SignatureTriggerBM_OriginalFileNameBM_Etw_UnloadDriverBM_Etw_LoadDriverBM_Etw_UnloadDeviceBM_Etw_LoadDeviceBM_Etw_ResumeThreadBM_Etw_SuspendThreadBM_Etw_ResumeProcessBM_Etw_SuspendProcessBM_Etw_ServiceHostStartedBM_Etw_ServiceChangeAccountInfoBM_Network_FailureBM_Etw_ServiceStartedBM_Etw_ServiceStopBM_Etw_ProtectVmLocalBM_Etw_ServiceChangeBinaryPathBM_Etw_ServiceChangeStartTypeAL""L"%ls""%hS"BM_Etw_AllocVmRemoteBM_Etw_ProtectVmRemoteBM_Etw_V2CodeInjectionBM_Etw_ReadVmRemoteATTR_%08lxSigSeqThreatName{0, %ls, __attr_none__, %ls, %ls}0x%lXError while processing Event, i.e you're missing an event.Error while processing Event: ID = [%d], HR = [%lx]IsPePlusIsPeFileInfoIsPacked vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameCompanyNameCommentsLegalCopyrightProductNameFileDescriptionLegalTrademarksPeStaticCRC3LengthCRC1IatSkipCRC3CRC2CopyrightCommentsArchitectureTrademarksFileVersionPeStaticsEpSecSectionKCRC2KCRC1KCRC3InternalNameFileDescriptionOriginalFileNamePEUnknownx86ia64x64 vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilename vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: \Unknown member: doshdr.%spevars not availableUnknown member: pehdr.%sInvalid index in DataDirectory: %dInvalid index in opclog: %dInvalid index in fopclog2: %dInvalid index in epcode: %dInvalid index in fopclog: %dUnknown member: peattributes.%sInvalid section %d or bigger than NumberOfSection=%d!__mmap_ex() failedpe_fofs_to_mofs failed!__mmap_ex(%d) failedmmap_patch(): buffer is emptymmap_patch_buff() failedpe_mofs_to_fofs(%d) failedUfsSeekRead(%d) failedImageName is NULLStringCchCopyA failedFileDescriptionInternalNameCompanyNamepe.get_versioninfo() failed to create the StringVersionIterator: %sInvalid sigattr_head indexpe.vm_search: mask_size != buffer_sizeInvalid index in netmetadata.tokens: %dpe.get_fixedversioninfo() failed to create the StringVersionIterator: %sFileVersionFileTypeFileSubtypeFileDateOriginalFilenameProductVersionFileFlagsMaskFileFlagsFileOSpe.metadata_decode: decode failed for 0x%xInvalid index in v->imps: %dfnrvape.metadata_decode: Invalid field index %d (should be 1-based)9m vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: ClearOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: $OFNAllowIdenticalNamesClearOriginalFileName vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: mZOriginalFileNameMaintenanceWindow vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: mZOriginalFileNameMaintenanceWindowprocessed%zd files in Moac, %zd skipped (cached), %zd filename setOriginalFileName Maintenance:HintENG:OFNPROCESSED:) vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: .?AVCMaintenanceOriginalFileNameTask@@ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameBTR.sysZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameoffreg.dllj% vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameKSLDriver.sysZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameKSLD.sysZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameMsMpEngCP.exeZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameMsMpEngSvc.dllZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenamempengine.dllZ vs BrowserUpdate.exe
Source: BrowserUpdate.exe	Binary or memory string: OriginalFilenameMpGear.dllZ vs BrowserUpdate.exe

Source: BrowserUpdate.exe

Static PE information: Section: .reloc ZLIB complexity 1.5

Source: BrowserUpdate.exe	Binary string: C\device\
Source: BrowserUpdate.exe	Binary string: \Enum\SecurityMmCopyMemoryHalGetBusDataByOffsetDeviceNameVersion\Device\\DosDevices\AllowedProcessNameImagePathExistingPageFilesPagingFiles\Session Manager\Memory Management\??\ \device\physicalmemoryKslDriver -- LPC Vendor id = 0x%0x, Device id = 0x%0x BaseClass= 0x%x status= 0x%x PhysAddr= %x PhysEnd= %x Pa2= %x PaEnd2= %x
Source: BrowserUpdate.exe	Binary string: m\Device\Harddisk%lu\Partition0\DR\Device\Harddisk%lu\Partition%luMpBootRecordCleanStoreSimulationModeMpDisableBootRecordCleanStore
Source: BrowserUpdate.exe	Binary string: \Device\HarddiskDmProfileImagePathS-1-5-18\ntuser.datSoftware\Microsoft\Windows NT\CurrentVersion\ProfileList\Device\HarddiskVolume\AppData\Local\VirtualStore%%%ls%%%WINDIR%\system32\driversS-1-5-20S-1-5-19.DEFAULT%Default%%AllUsersProfile%%DefaultUserProfile%\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\hivelistSYSTEM\CurrentControlSet\Control\Session Manager\EnvironmentSYSTEM\CurrentControlSet\Control\Session Manager\SFCSoftware\Microsoft\Windows\CurrentVersionUSER\MACHINE\SELECT 1 FROM SQLITE_MASTER WHERE type=? AND name=? LIMIT 1;create BEGIN IMMEDIATE;COMMIT;INSERT INTO FileHashes(Key, VSN, FileID, USN, InstanceTimeStamp, SHA1, MD5, SHA256, LSHASH, LSHASHS, CTPH, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n) VALUES(?, ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?);CRE%!.15g:
Source: BrowserUpdate.exe	Binary string: \device\harddisk*Processing new exclusion list (ID=%ld)Defender_Engine_Global_Exclusions_UpdatedFinished processing new exclusion list (ID=%ld)\\.\globalroot\\\localhost\\\?\UNC\localhost\\\localhost
Source: BrowserUpdate.exe	Binary string: MmCopyMemory\device\physicalmemoryeaxebxecxedxebpesiediespcsdsesfsgssscr0cr2cr3cr4gdtridtrldtrtrdeviceeflagspcountsysentrdebugramsize
Source: BrowserUpdate.exe	Binary string: \Device\
Source: BrowserUpdate.exe	Binary string: :\.GPgk+)z'^(Message.%zu)(Message.%zu: %hs - %hs)No subject0123456789ABCDEFescape() is not a constructor%PATH%PE_VIRTUALIZER_ipc$\Device\WebDavRedirector\\Device\Mup\\Device\LanmanRedirector\\Device\WinDfs\\Device\vmsmb\DAA
Source: BrowserUpdate.exe	Binary string: \\.\vfz\%pMpDisableSkipPlaceholderFilesMpDisableScanReparsePointsOfflineFilesMpDisableLastAccessTimeUpdate\device\harddiskvolumeMpDisableRegkeyInlineScriptScanning\Windows\TypeImagePathsvchost\PARAMETERS\\SERVICEDLLHKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\.lnkMICROSOFT PIFEX
Source: BrowserUpdate.exe	Binary string: S\Device\CdRom\Device\HarddiskVolumeDisk\Device\`%
Source: BrowserUpdate.exe	Binary string: IRP_MJ_MAXIMUM_FUNCTIONIRP_MJ_PNPIRP_MJ_PNP_POWERIRP_MJ_QUERY_QUOTAIRP_MJ_SET_QUOTAIRP_MJ_SYSTEM_CONTROLIRP_MJ_DEVICE_CHANGEIRP_MJ_SET_SECURITYIRP_MJ_POWERIRP_MJ_CREATE_MAILSLOTIRP_MJ_QUERY_SECURITYIRP_MJ_LOCK_CONTROLIRP_MJ_CLEANUPIRP_MJ_INTERNAL_DEVICE_CONTROLIRP_MJ_SHUTDOWNIRP_MJ_FILE_SYSTEM_CONTROLIRP_MJ_DEVICE_CONTROLIRP_MJ_SET_VOLUME_INFORMATIONIRP_MJ_DIRECTORY_CONTROLIRP_MJ_FLUSH_BUFFERSIRP_MJ_QUERY_VOLUME_INFORMATIONIRP_MJ_QUERY_EAIRP_MJ_SET_EAIRP_MJ_QUERY_INFORMATIONIRP_MJ_SET_INFORMATIONIRP_MJ_READIRP_MJ_WRITEIRP_MJ_CREATE_NAMED_PIPEIRP_MJ_CLOSEIRP_MJ_CREATE\Device\HardDisk%1!d!\Partition0Alureon[
Source: BrowserUpdate.exe	Binary string: 7zXZ\SystemRoot\Device\0123456789ABCDEF0123456789abcdefpea_epscn_islastpea_epcallnextpea_secmissizepea_epatstartlastsectpea_entrybyte60pea_entrybyte90pea_epiniatpea_usesuninitializedregspea_prefetchtrickspea_issuspiciouspea_isgenericpea_isreportedpea_aggressiveimportpea_enable_binlibpea_enable_lshashpea_many_importspea_self_modifying_codepea_track_direct_importspea_detects_vmpea_detects_vmwarepea_detects_virtualpcpea_is_delphipea_uses_single_steppingpea_uses_bound_exceptionspea_uses_div_by_zeropea_uses_int_overflowpea_uses_invalid_opcodespea_uses_unusual_breakpointpea_checks_if_debugged_documentedpea_disable_io_redirectionpea_suspicious_rebasepea_disable_drop_mz_onlypea_suspicious_stack_geometrypea_suspicious_subsystempea_suspicious_timestamppea_suspicious_valignpea_suspicious_section_fsizepea_suspicious_section_characteristicspea_aggressive_trim_wspea_16bitmachinepea_system_filepea_suspicious_number_of_dirspea_force_unpackingpea_extended_pestaticpea_small_data_directory_countpea_multiple_relocs_same_locationpea_relocs_but_no_relocs_flagpea_suspicious_imagebasepea_no_section_tablepea_no_sectionspea_many_sectionspea_suspicious_image_sizepea_bound_imports_inside_imagepea_delay_load_imports_inside_imagepea_entrypoint_in_import_tablepea_entrypoint_in_headerpea_import_via_tlspea_epsec_not_executablepea_othermachine_imagepea_checks_teb_lasterrorpea_disable_vmprotectpea_checks_teb_laststatuspea_disable_thread_apicall_limitpea_deep_apicall_limitpea_dynmem_uses_div_by_zeropea_dynmem_uses_int_overflowpea_dynmem_uses_bound_exceptionspea_dynmem_uses_privinstrpea_dynmem_uses_breakpointspea_dynmem_uses_single_steppingpea_dynmem_uses_invalid_opcodespea_dynmem_uses_unusual_breakpointpea_dynmem_detects_vmpea_dynmem_detects_vmwarepea_dynmem_detects_virtualpcpea_dynmem_checks_if_debugged_docpea_dynmem_checks_if_debugged_undocpea_dynmem_kernel_scanpea_dynmem_self_modifying_codepea_dt_continue_after_unpackingpea_dt_continue_after_unpacking_damagedpea_loop_jmp_chainpea_droppedpea_reads_vdll_codepea_dynmem_reads_vdll_codepea_verbose_vdll_readspea_scan_internal_datapea_isvbpcodepea_ARM_legacypea_ARM_big_endianpea_ARM_unpredictablepea_isappcontainerpea_checks_ntglobalflagpea_dynmem_checks_ntglobalflagpea_dynmem_checks_processheappea_dt_error_heur_exit_criteriapea_dt_error_too_many_prefixespea_dt_error_invalid_opcodepea_dt_error_too_many_operandspea_dt_error_bb_limitpea_dt_error_loop_too_complexpea_executes_from_last_sectionpea_executes_from_resourcespea_memory_patchedpea_uses_sysenterpea_suspicious_resource_directory_sizepea_suspicious_import_directory_sizepea_invalid_ilt_entrypea_dmg_machinepea_dmg_filealignmentpea_dmg_pointertorawdatapea_dmg_virtualaddresspea_dmg_truncatedpea_dmg_special_sectionpea_dmg_relocationspea_dmg_overlapping_sectionspea_dmg_optional_magicpea_dmg_sizeofheaderspea_dmg_imagebasepea_dmg_imagesizepea_dmg_unsupportedpea_dmg_importspea_dmg_invaliddatapea_dmg_decompresspea_dmg_virtualsizepea_dmg_not_executable_imagepea_dmg_entrypointpea_inv_sizeofoptio
Source: BrowserUpdate.exe	Binary string: \Device\Harddisk%lu\\.\MountPointManager
Source: BrowserUpdate.exe	Binary string: ,Partition\Device\Harddisk
Source: BrowserUpdate.exe	Binary string: MpDisableDirectedScanExtendedLatentScan\Device\HarddiskVolumecaller
Source: BrowserUpdate.exe	Binary string: \Device\HarddiskPartitionPACKEDBINARY.%016llX

Source: BrowserUpdate.exe	Binary or memory string: *GraLOH.vbp7hVA3
Source: BrowserUpdate.exe	Binary or memory string: *[]GraLOH.vbp7hVA3

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\BrowserUpdate.exe

File opened: C:\Windows\system32\666d41a7b4f4c851e6ab055a75eddf8d06d59c7d7c7e2f1aafbc9dab4cbf23a1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Users\user\Desktop\BrowserUpdate.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT 1 FROM SQLITE_MASTER WHERE type=? AND name=? LIMIT 1;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO FileLowFiAsync(Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp) VALUES(?, ? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM ProcessBlockHistory WHERE ProcessPath = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO AnomalyInfo(Key, UnbiasedTime) VALUES (?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(13, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM AutoFeatureControl;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT DISTINCT TableName FROM AnomalyTables;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM FileHashes WHERE FileHashes.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM RansomwareDetections;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM NetworkIpFirewallRules;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO RollingQueuesValues(EntryTable, EntryKey, EntryValue, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, VSN, FileID, USN, InstanceTimeStamp, SHA1, MD5, SHA256, LSHASH, LSHASHS, CTPH, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n FROM FileHashes WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM FileLowFiAsync;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID from RecordIdentifier WHERE Key = ? AND RecordTimeStamp = ? ;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM SystemFileCache WHERE CleanFileShaHash = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(6, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(14, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ? ORDER BY TimeStamp DESC;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE RuleId = ? ORDER BY TimeStamp DESC;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(4, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, Name, Capacity, TimeToLive, Mode FROM RollingQueuesTables WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO BmFileStartupActions(FilePathHash, FilePath, ActionFlags, ProcessStartCount, FdrFlags, FdrThreatRecordId, EvaluatorThreatRecordId, TrustedInstallerThreatRecordId, LFRThreatRecordId) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO BmFileActions(FileInfoId, ThreatRecordId, Action) VALUES (?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(5, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, Name, Count, InsertTime, ExpireTime, UpdateTime, ScalarFactor, LinearFactor, DecayInterval, HighCount, LastDecayTime FROM AtomicCounters WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM FolderGuardPaths WHERE UserIdHash = ? LIMIT 1;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO RansomwareDetections(Key, DetectionGuid, LkgTS, NextUSN, DetectionTS, ProvisionalRemedComplTS, RemedComplTS, ImpactedCBPNameSpaces, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(12, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT CleanFileSha, CleanFileShaHash FROM SystemFileCache WHERE InstanceTimeStamp < ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT PersistId, PersistIdBlob, ExpirationDate FROM AmsiFileCache WHERE ExpirationDate < DateTime(?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO DynSigRevisions(Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, RecordTimeStamp, Generation FROM RecordIdentifier WHERE RecordIdentifier.ID IN (SELECT FileInstance.RecordID from FileInstance WHERE FileInstance.ParentRecordID = ? );
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT RuleAction, RuleId, IsAudit, IsInherited, State FROM BmHipsRuleInfo WHERE ProcessInfoId = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, FirewallRuleName, ExpiryTime FROM NetworkIpFirewallRules WHERE ExpiryTime < ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM SystemFileCache;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC LIMIT 1;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO BmFileInfo(NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM SdnEx;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(3, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO FileInstance(InstanceTimeStamp, RecordID, ScanID, TrackingEnabled, StorageEvent, StorageEventState, ModificationsCount, ParentRecordID, Parent_FileEvent, Parent_FileName, Parent_ProcessID, Remote_ProcessID, FileID, FileName, USN, CreateTime, LastAccessTime, LastWriteTime, Signer, SignerHash, Issuer, SigningTime, MOTW, MOTWFromParent,IsValidCert, CertInvalidDetails, IsCatalogSigned) VALUES(?, ? , ?, ?, ?, ? , ? , ? , ? , ? , ?, ?, ?, ?, ?, ? , ? , ? , ? , ? , ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT EntryTable, EntryKey, EntryValue, InsertTime, ExpireTime FROM RollingQueuesValues WHERE EntryTable = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO AtomicCounters(Key, Name, Count, InsertTime, ExpireTime, UpdateTime, ScalarFactor, LinearFactor, DecayInterval, HighCount, LastDecayTime) VALUES(? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Version, Current, LastUpdated FROM SQLiteGlobals WHERE Current = 1 ORDER BY Version DESC ;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM AmsiFileCache WHERE AmsiFileCache.PersistId = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO AttributeCounts(Key, Name, Count, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(28, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO AttributePersistContext(Key, FilePath, Context, InsertTime, ExpireTime) VALUES(? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE AtomicCounters SET Name = ?, Count = ?, InsertTime = ?, ExpireTime = ?, UpdateTime = ?, ScalarFactor = ?, LinearFactor = ?, DecayInterval = ?, HighCount = ?, LastDecayTime = ?, WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID from File WHERE SHA1 = ? ;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO ScanInfo(SigSeq, PersistSigSeq, ProgenitorPersistSigSeq, ScanAgent, NamedAttributes, PeAttributes, SigAttrEvents, ScanReason, WebURL, EngineID, SigSha) VALUES(? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? );
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(DISTINCT ProcessPath) FROM ProcessBlockHistory;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM Engine WHERE EngineVersion = ? AND SigVersion = ? ;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO AmsiFileCache(PersistId, PersistIdBlob, ExpirationDate) VALUES (?, ?, DateTime('now', ?));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM AttributePersistContext;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM SystemRegistryCache;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(24, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID, NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(11, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO RansomwareDetections(Key, DetectionGuid, LkgTS, NextUSN, DetectionTS, ProvisionalRemedComplTS, RemedComplTS, ImpactedCBPNameSpaces, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM RansomwareDetections WHERE InstanceTimeStamp < ?; SELECT Count(1) FROM RansomwareDetections;DELETE FROM RansomwareDetections WHERE Key = ?;SELECT DetectionGuid, LkgTS, NextUSN, DetectionTS, ProvisionalRemedComplTS, RemedComplTS, ImpactedCBPNameSpaces FROM RansomwareDetections WHERE Key = ?;SELECT ID FROM RansomwareDetections WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(31, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO BmFileStartupActions(FilePathHash, FilePath, ActionFlags, ProcessStartCount, FdrFlags, FdrThreatRecordId, EvaluatorThreatRecordId, TrustedInstallerThreatRecordId, LFRThreatRecordId) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM BmFileStartupActions WHERE BmFileStartupActions.FilePathHash = ?;SELECT Count(1) FROM BmFileStartupActions;SELECT ID FROM BmFileStartupActions WHERE BmFileStartupActions.FilePathHash = ?;SELECT FilePathHash, FilePath, ActionFlags, ProcessStartCount, FdrFlags, FdrThreatRecordId, EvaluatorThreatRecordId, TrustedInstallerThreatRecordId, LFRThreatRecordId FROM BmFileStartupActions WHERE FilePathHash = ?\|
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT InfectedFileSHA, ProcFileId, SystemFilePath, CleanFileSha FROM SystemFileCache WHERE InfectedFileSHAHash = ? OR ProcFileIDSystemFileHash = ? ORDER BY InstanceTimeStamp DESC;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE RuleId = ? ORDER BY TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory ORDER BY TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ? ORDER BY TimeStamp DESC;SELECT COUNT(DISTINCT ProcessPath) FROM ProcessBlockHistory;DELETE FROM ProcessBlockHistory;SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory WHERE RuleId = ? GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory WHERE ProcessPath = ? ORDER BY TimeStamp DESC LIMIT 1;DELETE FROM ProcessBlockHistory WHERE ProcessPath = ? AND TimeStamp = ?;SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;SELECT ID FROM ProcessBlockHistory WHERE ProcessPath = ?;SELECT COUNT(1) FROM ProcessBlockHistory;DELETE FROM ProcessBlockHistory WHERE TimeStamp < ?;REPLACE INTO ProcessBlockHistory(ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity) VALUES (?, ?, ?, ?, ?, ?, ?, ?);SELECT ProcessPath, TimeStamp FROM ProcessBlockHistory ORDER BY TimeStamp ASC LIMIT 1[3
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM FileLowFiAsync WHERE FileLowFiAsync.Key = ?; DELETE FROM FileLowFiAsync WHERE FileLowFiAsync.Key = ?; SELECT Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp FROM FileLowFiAsync WHERE Key = ?; DELETE FROM FileLowFiAsync WHERE InstanceTimeStamp < ?; SELECT COUNT(1) FROM FileLowFiAsync; INSERT INTO FileLowFiAsync(Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp) VALUES(?, ? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM AutoFeatureControl WHERE AutoFeatureControl.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO AnomalyTables(Key, TableKey, TableName, KeyName, FirstSeen, LastSeen, UnbiasedMinutes, Value, Order_) VALUES(? , ? , ? , ? , ? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO SystemFileCache(InfectedFileSHAHash, InfectedFileSHA, ProcFileIDSystemFileHash, ProcFileId, SystemFilePath, CleanFileSha, CleanFileShaHash, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(16, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(8, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(26, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, TableKey, TableName, KeyName, FirstSeen, LastSeen, UnbiasedMinutes, Value, Order_ FROM AnomalyTables WHERE AnomalyTables.TableKey = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM AnomalyTables;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(DISTINCT UserIdHash) FROM FolderGuardPaths;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID, PPIDHash, ProcessStartTime, PID, StructVersion, ImageFileName, MonitoringFlags_Flags, MonitoringFlags_VmHardenType, MonitoringFlags_ExemptVmHardenedTypes, CommandLineArgs, HipsInjectionId, FolderGuardId, Flags, LsassReadMemId, MonitoringFlags_Flags2Low, MonitoringFlags_Flags2High FROM BmProcessInfo WHERE PPIDHash = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO AutoFeatureControl(Key, CurrCount, MaxCount, InstanceTimeStamp) VALUES (?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM AtomicCounters ORDER BY InsertTime ASC LIMIT 1;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID, NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;INSERT INTO BmFileActions(FileInfoId, ThreatRecordId, Action) VALUES (?, ?, ?);SELECT ThreatRecordId, Action FROM BmFileActions WHERE FileInfoId == ?;INSERT INTO BmFileInfo(NormalizedPathHash, DosPathHash, StructVersion, NormalizedPath, DosPath, Wow64Context, MetaContext, IsFromWeb, IsExecutable) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;DELETE FROM BmFileActions;DELETE FROM BmFileInfo;SELECT ID FROM BmFileInfo WHERE NormalizedPathHash = ? OR DosPathHash = ?;SELECT Count(1) FROM BmFileInfo;B
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(20, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT PersistId, PersistIdBlob, ExpirationDate FROM AmsiFileCache WHERE PersistId = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM AtomicCounters WHERE AtomicCounters.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(18, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM BmProcessInfo WHERE PPIDHash = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM AnomalyInfo;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ValueMapArrayBlob FROM ValueMapArray WHERE Key = ? AND RecordType = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM SystemFileCache WHERE InfectedFileSHAHash = ? OR ProcFileIDSystemFileHash = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM AttributeCounts WHERE AttributeCounts.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, FilePath, Context, InsertTime, ExpireTime FROM AttributePersistContext WHERE Key = ?; SELECT COUNT(1) FROM AttributePersistContext; MpFileStashMaxSizeMpOplocksInSpynetFileSizeLimitMpDisableValidateTrustUseInternalCertFormatMpDisableOSXValidateTrustMpValidateTrustMSIMaxOverlayMpDisableValidateTrustAllowBadCertDirectory%WINDIR%\System32\catroot2%WINDIR%\System32\CatRootMpDisableValidateTrustInternalMachOInfinite loop detected (more that %d instructions executed)PE_SUCCESSPE_END_ENUMERATIONPE_NOMEMORYPE_OVERLAPPINGPE_READPE_WRITEPE_FILEPE_DECOMPRESS_ERRORPE_NOTIMPLEMENTEDPE_UNSUPPORTED_MACHINE_ARCHITECTUREPE_INVALID_SIZEOFOPTIONALHEADERPE_INVALID_OPTIONAL_MAGICPE_INVALID_SIZEOFIMAGEPE_INVALID_IMAGEBASEPE_INVALID_SECTIONALIGNMENTPE_INVALID_FILEALIGNMENTPE_INVALID_DOS_SIGNATUREPE_INVALID_E_LFANEWPE_INVALID_NT_SIGNATUREPE_INVALID_SIZEOFHEADERSPE_INVALID_ARGUMENTSPE_INVALID_VIRTUALSIZEPE_INVALID_VIRTUALADDRESSPE_INVALID_RAWOFFSETPE_INVALID_RAWSIZEPE_INVALID_RVAPE_INVALID_EXPORTSPE_INVALID_DATAPE_ERROR_RESERVEDMpMaxPeExportsInCoreReportsMpMapsHeartbeatDistributionIntervalMpRemediationCheckpointLiveDelayMpMaxSpynetReportsMpMapsHeartbeatDelayOnDetectionMpEnableFriendlyCloudCheckMpDisableMDMPolicyChecksMpHeartbeatControlGroupMpDisableMpsigstubErrorMapsHeartbeatMpDisableExclusionsMapsHeartbeatMpDisableMapsDisableMapsHeartbeatMpDisablePaidEnhancedMapsHeartbeatMpDisableEnhancedMapsHeartbeatMpUrlReputationTimeoutMpMaxRtsdBatchSizeMpEnhancedMapsHeartbeatRateMpDisableRtpChangeMapsHeartbeatMpDisableUninstallMapsHeartbeatMpMapsHeartbeatDelayMpEnableUefiEnumerationInHeartBeatMpDisableUrlReputationMapsMpDisableErrorMapsHeartbeatMpMaxNetworkConnectionReportsInSpynetMpMapsHeartbeatDetectionIntervalMpDisableCachingSampleSubmittedShasMpDisableRemediationCheckpointsMpRemediationCheckpointTimeoutMpSampleSubmissionSizeLimitMpPaidEnhancedMapsHeartbeatDelayMpDisableSetupErrorMapsHeartbeatMpDisableOplocksInSpynetMpMapsHeartbeatRateMpEnhancedMapsHeartbeatDelayMpMaxRtsdCountMpDisablePersistScanHandleOnThreatNotFoundMpDisableAdvSSAndFallbackToWatsonMpDisableSenseHeartbeatEtwMpDisableNetworkInfoInHeartbeatMpDisableRemediationFailTelemetryMpFirmwareEnvironmentVariableQueriesMpDisableDefenderDisableMapsHeartbeatMpDisableTestErrorMapsHeartbeatMpDisableOfflineEnhancedMapsHeartbeatMpOfflineEnhancedMapsHeartbeatRateMpDisableDnsCacheSubmissionWithNRICacheMpOfflineEnhancedMapsHeartbeatDelayMpDisableUrlReputationMapsCachet
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM AttributeCounts ORDER BY InsertTime ASC LIMIT 1;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT t1.ProcessPath, t1.TimeStamp, t1.TargetPath, t1.RuleId, t1.IsAudit, t1.Action, t1.ProcessTaintReason, t1.ProcessIntegrity FROM ProcessBlockHistory AS t1 INNER JOIN(SELECT ID, ProcessPath, MAX(TimeStamp) AS MostRecentTime FROM ProcessBlockHistory WHERE RuleId = ? GROUP BY ProcessPath) AS t2 ON t1.ID = t2.ID AND t1.TimeStamp = t2.MostRecentTime ORDER BY t1.TimeStamp DESC;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM ValueMapArray WHERE ValueMapArray.Key = ? AND ValueMapArray.RecordType = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(21, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM BmFileInfo;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM AtomicCounters;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ThreatRecordId, Action FROM BmFileActions WHERE FileInfoId == ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(17, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO BmHipsRuleInfo(ProcessInfoId, RuleAction, RuleId, IsAudit, IsInherited, State) VALUES (?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE AttributePersistContext SET FilePath = ?, Context = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO ProcessInfo(FileName, ProcessId, CommandLine, StartTime, TokenElevation, TokenElevationType, IntegrityLevel) VALUES(? , ? , ? , ? , ? , ? , ? );
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, RecordTimeStamp, Generation FROM RecordIdentifier WHERE ID = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(32, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM AttributePersistContext WHERE AttributePersistContext.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(19, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM NetworkIpFirewallRules WHERE NetworkIpFirewallRules.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO BackupProcessInfo(Key, FilePath, FirstStartTime, NextUSN, AutomaticRemovalPolicy, ImpactedCBPNameSpaces, InstanceTimeStamp) VALUES ( ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(22, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM RansomwareDetections WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM SdnEx WHERE SdnEx.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(32, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(29, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM SystemRegistryCache WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM AttributeCounts;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM AmsiFileCache;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM AnomalyTables WHERE AnomalyTables.TableKey = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO SystemRegistryCache(Key, FileIDHash, RegPath, RegOperation, NewRegType, OldRegType, OldRegData, NewRegData, InstanceTimeStamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO File(SHA1, MD5, lshashs, lshash, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n, Size, SHA256) VALUES(? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?, ?, ? );
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(30, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(23, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM RollingQueuesValues;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO SdnEx(Key, CurrentCount) VALUES (?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(15, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(10, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO BmProcessInfo(PPIDHash, ProcessStartTime, PID, StructVersion, ImageFileName, MonitoringFlags_Flags, MonitoringFlags_VmHardenType, MonitoringFlags_ExemptVmHardenedTypes, CommandLineArgs, HipsInjectionId, FolderGuardId, Flags, LsassReadMemId, MonitoringFlags_Flags2Low, MonitoringFlags_Flags2High)VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM BackupProcessInfo;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, FilePath, Context, InsertTime, ExpireTime FROM AttributePersistContext WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM ValueMapArray WHERE RecordType = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT FileInstance.ID FROM FileInstance, RecordIdentifier WHERE FileInstance.RecordID = RecordIdentifier.ID AND RecordIdentifier.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT RecordIdentifier.Key, FileInstance.RecordID, RecordIdentifier.RecordTimeStamp, FileInstance.TrackingEnabled, FileInstance.StorageEvent, FileInstance.StorageEventState, FileInstance.ModificationsCount, FileInstance.ParentRecordID, FileInstance.Parent_FileEvent, FileInstance.Parent_FileName, RecordIdentifier.Generation, FileInstance.FileName, FileInstance.USN, FileInstance.CreateTime, FileInstance.LastAccessTime, FileInstance.LastWriteTime, FileInstance.Signer, FileInstance.SignerHash, FileInstance.Issuer, FileInstance.SigningTime, FileInstance.MOTW, FileInstance.MOTWFromParent, FileInstance.IsValidCert, FileInstance.CertInvalidDetails, FileInstance.IsCatalogSigned, File.SHA1, File.MD5, File.lshashs, File.lshash, File.PartialCRC1, File.PartialCRC2, File.PartialCRC3, File.KCRC1, File.KCRC2, File.KCRC3, File.KCRC3n, File.Size, File.SHA256, ParentProcessInfo.CommandLine, ParentProcessInfo.FileName, ParentProcessInfo.IntegrityLevel, ParentProcessInfo.ProcessId, ParentProcessInfo.StartTime, ParentProcessInfo.TokenElevation, ParentProcessInfo.TokenElevationType, RemoteProcessInfo.CommandLine, RemoteProcessInfo.FileName, RemoteProcessInfo.IntegrityLevel, RemoteProcessInfo.TokenElevation, RemoteProcessInfo.TokenElevationType, ScanInfo.NamedAttributes, ScanInfo.PeAttributes, ScanInfo.PersistSigSeq, ScanInfo.ProgenitorPersistSigSeq, ScanInfo.ScanAgent, ScanInfo.ScanReason, ScanInfo.SigAttrEvents, ScanInfo.SigSeq, ScanInfo.SigSha, ScanInfo.WebURL,Engine.EngineVersion, Engine.SigVersion FROM RecordIdentifier INNER JOIN (FileInstance INNER JOIN File ON FileInstance.FileID = File.ID LEFT OUTER JOIN ProcessInfo as 'ParentProcessInfo' ON FileInstance.Parent_ProcessID = ParentProcessInfo.ID LEFT OUTER JOIN ProcessInfo as 'RemoteProcessInfo' ON FileInstance.Remote_ProcessID = RemoteProcessInfo.ID LEFT OUTER JOIN (ScanInfo INNER JOIN Engine ON ScanInfo.EngineID = Engine.ID) ON FileInstance.ScanID = ScanInfo.ID ) ON RecordIdentifier.ID = FileInstance.RecordID WHERE RecordIdentifier.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(9, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM DynSigRevisions;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM ProcessBlockHistory;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO ValueMapArray(Key, RecordType, ValueMapArrayBlob, InstanceTimeStamp) VALUES(?, ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, Name, Count, InsertTime, ExpireTime FROM AttributeCounts WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key, FileName, SigSeq, SigSha, SigIsSync, InstanceTimeStamp FROM FileLowFiAsync WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM BmFileStartupActions WHERE BmFileStartupActions.FilePathHash = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(1) FROM FileHashes;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM FileLowFiAsync WHERE FileLowFiAsync.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO RecordIdentifier(Key, RecordTimeStamp, Generation) VALUES(?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO FolderGuardPaths(UserIdHash, UserId, GUID, Path) VALUES ( ?, ?, ?, ? );SELECT Count(DISTINCT UserIdHash) FROM FolderGuardPaths;DELETE FROM FolderGuardPaths WHERE UserIdHash = ?;SELECT ID FROM FolderGuardPaths WHERE UserIdHash = ? LIMIT 1;SELECT UserId, GUID, Path FROM FolderGuardPaths WHERE UserIdHash = ?N
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(27, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E444F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO FileHashes(Key, VSN, FileID, USN, InstanceTimeStamp, SHA1, MD5, SHA256, LSHASH, LSHASHS, CTPH, PartialCRC1, PartialCRC2, PartialCRC3, KCRC1, KCRC2, KCRC3, KCRC3n) VALUES(?, ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT DetectionGuid, LkgTS, NextUSN, DetectionTS, ProvisionalRemedComplTS, RemedComplTS, ImpactedCBPNameSpaces FROM RansomwareDetections WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO NetworkIpFirewallRules(Key, FirewallRuleName, ExpiryTime) VALUES (?, ?, ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT FilePath, FirstStartTime, NextUSN, AutomaticRemovalPolicy, ImpactedCBPNameSpaces FROM BackupProcessInfo WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(7, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM RollingQueuesTables WHERE RollingQueuesTables.Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ProcessPath, TimeStamp, TargetPath, RuleId, IsAudit, Action, ProcessTaintReason, ProcessIntegrity FROM ProcessBlockHistory ORDER BY TimeStamp DESC;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO DynSigRevisions(Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);DELETE FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;SELECT Count(1) FROM DynSigRevisions;SELECT ID FROM DynSigRevisions WHERE DynSigRevisions.Key = ?;SELECT Key, SdnRevision, EsuRevision, BFRevision, EntCertRevision, TamperRevision, AGBlobRevision, BFFileAllowRevision, BFFileBlockRevision, BFCertAllowRevision, BFCertBlockRevision FROM DynSigRevisions WHERE Key = ?
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(2, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE AttributeCounts SET Name = ?, Count = ?, InsertTime = ?, ExpireTime = ? WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT (SELECT COUNT() FROM File) + (SELECT COUNT() FROM FileInstance);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO RollingQueuesTables(Key, Name, Capacity, TimeToLive, Mode) VALUES(? , ? , ? , ? , ?);
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO FolderGuardPaths(UserIdHash, UserId, GUID, Path) VALUES ( ?, ?, ?, ? );
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT ID FROM BackupProcessInfo WHERE Key = ?;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE SQLiteGlobals SET Current = 0 WHERE Current = 1; INSERT INTO SQLiteGlobals(Version, Current, LastUpdated) VALUES(25, 1, date('now'));
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Count(1) FROM BmFileStartupActions;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT Key FROM AttributePersistContext ORDER BY InsertTime ASC LIMIT 1;
Source: BrowserUpdate.exe, 00000000.00000002.2206356467.00007FF7E4631000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO Engine(EngineVersion, SigVersion) VALUES(? , ? );

Source: BrowserUpdate.exe	String found in binary or memory: models.tsvalueTypexl/theme/xl/_rels/ppt/tags/map[%s]%sEBWebViewargumentsprotectedtransient__VALUE__Try Againne-resizese-resizesw-resizenw-resizeBACKSPACEMEDIASTOPplaintextkeypointsmaskunitspointsatxpointsatypointsatzrepeatdurkeyPointsmaskUnitspointsAtXpointsAtYpointsAtZrepeatDurgdi32.dllCreateDCWCreateICWRectangleSetBkModeStartDocWStartPageLoadIconWReleaseDCEqualRectUnionRectEndDialogDrawTextWSetCursorSendInputAlt+ShiftMediaStopOEMPeriodaudio/oggvideo/oggimage/jxlvideo/jpmimage/bpgaudio/mp3audio/midaudio/apeaudio/wavaudio/amraudio/aacaudio/mp4video/3gpvideo/3g2video/asffont/sfntencoding=terminatedowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dll%!Weekday(short readdwmapi.dlluser32.dllIsValidSidLocalAllocLockFileExOpenEventWOpenMutexWOpenThreadPulseEventResetEventWSASocketW0123456789not a boolCreateFilecreatetemp/dev/stdincomplex128t.Kind == /etc/hosts.localhostwsarecvmsgwsasendmsgIP addressunixpacket netGo = execerrdotSYSTEMROOT for type text/plainnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pc12207031256103515625ParseFloatVT_ILLEGALChorasmianDevanagariGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOld_UyghurPhoenicianSaurashtraParseAddr(invalid IPskipping: ClassCSNETClassCHAOSAdditionalres binderres masterresumptionexp masterSHA256-RSASHA384-RSASHA512-RSADSA-SHA256ECDSA-SHA1 but have ConnectionKeep-Alivelocal-addrimage/webpimage/jpegaudio/aiffaudio/mpegaudio/midiaudio/wavevideo/webmfont/woff2Set-Cookiebytes */%d stream=%dset-cookieuser-agentkeep-alive:authorityconnectionUser-AgentHost: %s
Source: BrowserUpdate.exe	String found in binary or memory: using unaddressable valueunknown ABI parameter kind using zero Value argumentreflect.Value.MethodByNamereflect.Value.OverflowUintcannot marshal DNS messageunexpected type in connecttoo many colons in addressunclosed criterion bracketcriterion lacks equal signencountered a cycle via %sdots or key param is emptyall goroutines stack tracecall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesnegative idle mark workersuse of invalid sweepLockerfreedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallempty buffer in CopyBuffer1455191522836685180664062572759576141834259033203125As4 called on IPv6 addresssegment prefix is reservedECDSA verification failurebad certificate hash valuex509: malformed parametersx509: malformed extensionsx509: invalid simple chainread from empty dataBuffernet/http: request canceledstopped after 10 redirectsduplicate pseudo-header %qhttp2: Framer %p: wrote %vframe_windowupdate_bad_lenframe_priority_zero_streaminternal error: bad Writerhttp2: invalid Host headermalformed HTTP status codeaddress type not supportedHTTP Version Not SupportedreadLoopPeekFailLocked: %winvalid port %q after host_html_template_htmlescaper_html_template_attrescaperno templates in name spacetemplate escaped correctlyecdsa: invalid private keyed25519: bad seed length: cryptobyte: internal errorbase 128 integer too largetruncated base 128 integerasn1: invalid UTF-8 stringnon sequence tagged as setid (%v) <= evictCount (%v)malformed chunked encodingYCbCrSubsampleRatioUnknownunsupported JPEG feature: unknown component selectorpng: unsupported feature: IDAT chunk length overflowhexcolor\|rgb\|rgba\|hsl\|hsla^[-+]?[0-9]+(?:\.[0-9]+)?$^(9694[1-4])([ \-]\d{4})?$unterminated quoted stringunexpected . after term %qinvalid value; expected %sexpected integer; found %sexpected complex; found %stoo many slice indexes: %dnon-comparable type %s: %vchacha20: wrong nonce sizechacha20: counter overflownot a pointer to a struct.method '%s' not registeredmethod '%d' not registeredunknown Window message: %sEmbeddedBrowserWebView.dll%s%sthis%s = source["%s"];Error from monitor #%v, %vFailed to marshal data: %v-//ietf//dtd html strict//bare " in non-quoted-fieldIsClipboardFormatAvailableGdipCreateBitmapFromStreamAddClipboardFormatListenerError occurred in App.InitUnable to processIndexHTMLUnable to write content %sresponse has been finishedHasCurrentHeader Error: %sGetCurrentHeader Error: %sResp.GetHeaders failed: %sapplication/x-ms-installerapplication/vnd.ms-outlookapplication/x-unix-archiveapplication/vnd.adobe.xfdf
Source: BrowserUpdate.exe	String found in binary or memory: %s takes %d inputs. Received %dInvalid Set Log Level Message: ca-ES-valencia en-US-u-va-posixencodeReflectValue: nil elementcannot find type for %s (%s/%s)Call to GetKeyboardState failedunable to release mouse capturecan't handle scalars > 256 bits-//ietf//dtd html 2.0 level 1//-//ietf//dtd html 2.0 level 2//-//w3c//dtd html 3 1995-03-24//-//w3c//dtd html 4.0 frameset//-//webtechs//dtd mozilla html//application/x-windows-installer
Source: BrowserUpdate.exe	String found in binary or memory: http://support.google.com/installer/
Source: BrowserUpdate.exe	String found in binary or memory: ..\..\chrome\updater\app\app_install_win.ccUpdate success.No updates.Updater error: http://support.google.com/installer/%s?product=%s&error=%d installation completed: error category[], error_code[], extra_code1[], completion_message[], post_install_launch_command_line[]SetOemInstallState failedStoreRunTimeEnrollmentToken failed
Source: BrowserUpdate.exe	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: BrowserUpdate.exe	String found in binary or memory: .0\u to Write byteshttps://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.google.com/devicemanagement/data/apihttps://dl.google.com/update2/installers/icons/1:356l7w0
Source: BrowserUpdate.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: BrowserUpdate.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: BrowserUpdate.exe	String found in binary or memory: --help display this help and exit
Source: BrowserUpdate.exe	String found in binary or memory: --help display this help and exit
Source: BrowserUpdate.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: BrowserUpdate.exe	String found in binary or memory: asennuksen: $1oError sa pag-install: Nag-apply ang administrator ng network mo ng Group Policy na pumipigil sa pag-install: $1
Source: BrowserUpdate.exe	String found in binary or memory: Tapos na ang pag-install.
Source: BrowserUpdate.exe	String found in binary or memory: Kanselahin ang Pag-install
Source: BrowserUpdate.exe	String found in binary or memory: Error sa pag-install: $1
Source: BrowserUpdate.exe	String found in binary or memory: isvaatimuksia.fHindi na-install dahil hindi natutugunan ng iyong computer ang mga minimum na requirement sa hardware.mL'installation a
Source: BrowserUpdate.exe	String found in binary or memory: Inihinto ang Pag-install.
Source: BrowserUpdate.exe	String found in binary or memory: $1-installeerder
Source: BrowserUpdate.exe	String found in binary or memory: $1-Installationsprogramm
Source: BrowserUpdate.exe	String found in binary or memory: $1-installatieprogramma
Source: BrowserUpdate.exe	String found in binary or memory: $1-installasjonsprogram
Source: BrowserUpdate.exe	String found in binary or memory: .:Asennusvirhe: Asennusprosessin aloittaminen ei onnistunut.?Error sa pag-install: Hindi nagsimula ang proseso ng installer.GErreur d'installation
Source: BrowserUpdate.exe	String found in binary or memory: .LAsennusvirhe: Asennusohjelmaa ei suoritettu loppuun. Asennus on keskeytetty.LError sa pag-install: Hindi natapos ang installer. Na-abort ang pag-install.tErreur d'installation
Source: BrowserUpdate.exe	String found in binary or memory: Ini-install...
Source: BrowserUpdate.exe	String found in binary or memory: 3Asennus ei ole valmis. Haluatko varmasti perua sen?IHindi nakumpleto ang pag-install. Sigurado ka bang gusto mong kanselahin?9Installation non termin
Source: BrowserUpdate.exe	String found in binary or memory: uudelleen.#Hindi na-install. Pakisubukan ulit.,
Source: BrowserUpdate.exe	String found in binary or memory: isen virheen takia.FHindi na-install dahil sa isang internal na error sa server ng update.Q
Source: BrowserUpdate.exe	String found in binary or memory: ei tueta.OError sa pag-install: Invalid o hindi sinusuportahan ang filename ng installer.fErreur d'installation
Source: BrowserUpdate.exe	String found in binary or memory: ivityspalvelimella ei ole tiivistedataa sovelluksesta.\Hindi na-install dahil walang anumang data ng hash para sa application ang server ng update.p
Source: BrowserUpdate.exe	String found in binary or memory: n versiota ei tueta.QHindi na-install dahil hindi sinusuportahan ang bersyong ito ng operating system.ZL'installation a
Source: BrowserUpdate.exe	String found in binary or memory: maassa.AHindi na-install dahil pinaghihigpitan ang access sa bansang ito.=L'installation a
Source: BrowserUpdate.exe	String found in binary or memory: Ituloy ang Pag-install
Source: BrowserUpdate.exe	String found in binary or memory: n.\Salamat sa pag-install. Dapat mong i-restart ang lahat ng iyong browser bago gamitin ang $1.eMerci d'avoir install
Source: BrowserUpdate.exe	String found in binary or memory: n.SSalamat sa pag-install. Dapat mong i-restart ang iyong browser bago gamitin ang $1.aMerci d'avoir install
Source: BrowserUpdate.exe	String found in binary or memory: n.TSalamat sa pag-install. Dapat mong i-restart ang iyong computer bago gamitin ang $1.aMerci d'avoir install
Source: BrowserUpdate.exe	String found in binary or memory: .4Asennus ei onnistu, palvelin ei tunnista sovellusta.9Hindi na-install, hindi kilala ng server ang application.=Installation impossible. Le serveur ne reconna
Source: BrowserUpdate.exe	String found in binary or memory: onnistui, koska protokollaa ei tueta.BHindi na-install dahil sa error na hindi sinusuportahang protocol.K
Source: BrowserUpdate.exe	String found in binary or memory: Naghihintay sa pag-install...
Source: BrowserUpdate.exe	String found in binary or memory: Handles start/stop monitor commands as well as other feedback to the app profiling flow
Source: BrowserUpdate.exe	String found in binary or memory: Handles start/stop monitor commands as well as other feedback to the app profiling flow
Source: BrowserUpdate.exe	String found in binary or memory: CLuaScriptActionRestore_WU_BITS() out of memoryRestore_WU_BITS() abortedService Restore final statusHKLM\SYSTEM\CurrentControlSet\Services\wuauserv%systemroot%\system32\qmgr.dllBITS Start/Stop pends > 12 seconds%systemroot%\system32\wuaueng.dllOpenServiceW failed for %lsStart Service failed for %lsOpenSCManager failedHKLM\SYSTEM\CurrentControlSet\Services\BITSnew CSysioRepositoryFile out of memory%ls was restored%ls successfully started.StartServiceW failed for %ls%ls was not restored because MpDisableAutomaticServiceDllRestoration is setInternal error, wrong dll name %lsServiceRestorationGetFileFromCleanStore() failed for %lsInvestigate SERVICE_STATUS_PROCESS.dwServiceSpecificExitCode set to it for %lsGetSpecialDefaultData failed for %ls%ls registry restoredDefaultRegkey restoration failed for %lsQueryServiceStatusEx failed for %lsInvestigate SERVICE_STATUS_PROCESS.dwWin32ExitCode set to it for %lsU-
Source: BrowserUpdate.exe	String found in binary or memory: CLuaScriptActionRestore_WU_BITS() out of memoryRestore_WU_BITS() abortedService Restore final statusHKLM\SYSTEM\CurrentControlSet\Services\wuauserv%systemroot%\system32\qmgr.dllBITS Start/Stop pends > 12 seconds%systemroot%\system32\wuaueng.dllOpenServiceW failed for %lsStart Service failed for %lsOpenSCManager failedHKLM\SYSTEM\CurrentControlSet\Services\BITSnew CSysioRepositoryFile out of memory%ls was restored%ls successfully started.StartServiceW failed for %ls%ls was not restored because MpDisableAutomaticServiceDllRestoration is setInternal error, wrong dll name %lsServiceRestorationGetFileFromCleanStore() failed for %lsInvestigate SERVICE_STATUS_PROCESS.dwServiceSpecificExitCode set to it for %lsGetSpecialDefaultData failed for %ls%ls registry restoredDefaultRegkey restoration failed for %lsQueryServiceStatusEx failed for %lsInvestigate SERVICE_STATUS_PROCESS.dwWin32ExitCode set to it for %lsU-
Source: BrowserUpdate.exe	String found in binary or memory: u<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
Source: BrowserUpdate.exe	String found in binary or memory: uuid: xmlns="<wsa:ReplyTo><wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address></wsa:ReplyTo>

Source: C:\Users\user\Desktop\BrowserUpdate.exe

File read: C:\Users\user\Desktop\BrowserUpdate.exe

Jump to behavior

Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Section loaded: wintypes.dll	Jump to behavior

Source: BrowserUpdate.exe

Static PE information: certificate valid

Source: BrowserUpdate.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: BrowserUpdate.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: BrowserUpdate.exe

Static file information: File size 55469264 > 1048576

Source: BrowserUpdate.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x87e600
Source: BrowserUpdate.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1f7600
Source: BrowserUpdate.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x626200
Source: BrowserUpdate.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x16abe00
Source: BrowserUpdate.exe	Static PE information: Raw size of rcdata is bigger than: 0x100000 < 0xd48000

Source:	Binary string: MpGear.pdb source: BrowserUpdate.exe
Source:	Binary string: BTR.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: KSLDriver.pdb source: BrowserUpdate.exe
Source:	Binary string: KSLD.pdb source: BrowserUpdate.exe
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb source: BrowserUpdate.exe
Source:	Binary string: offreg.pdbH source: BrowserUpdate.exe
Source:	Binary string: KSLDriver.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: MsMpEngCP.pdb source: BrowserUpdate.exe
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: BrowserUpdate.exe, 00000000.00000002.2226332115.00007FF7E53C8000.00000080.00000001.01000000.00000003.sdmp, BrowserUpdate.exe, 00000000.00000000.2111947960.00007FF7E5386000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb0 source: BrowserUpdate.exe
Source:	Binary string: BTR.pdb source: BrowserUpdate.exe
Source:	Binary string: MsMpEngSvc.pdb source: BrowserUpdate.exe
Source:	Binary string: mpengine.pdb source: BrowserUpdate.exe
Source:	Binary string: MsMpEngSvc.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: offreg.pdb source: BrowserUpdate.exe
Source:	Binary string: KSLD.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: MsMpEngCP.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: BrowserUpdate.exe, 00000000.00000002.2226332115.00007FF7E53C8000.00000080.00000001.01000000.00000003.sdmp, BrowserUpdate.exe, 00000000.00000000.2111947960.00007FF7E5386000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: MpGear.pdbGCTL source: BrowserUpdate.exe
Source:	Binary string: mpengine.pdbOGPS source: BrowserUpdate.exe

Source: initial sample

Static PE information: section where entry point is pointing to: rcdata

Source: BrowserUpdate.exe	Static PE information: section name: .xdata
Source: BrowserUpdate.exe	Static PE information: section name: rcdata

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\BrowserUpdate.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\BrowserUpdate.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\BrowserUpdate.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\BrowserUpdate.exe

API/Special instruction interceptor: Address: 7FF8C88ED6C4

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\BrowserUpdate.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C0003E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IDA PRO\IDAQ.EXEP
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000086000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\FIDDLER\FIDDLER.EXE
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER\FIDDLER.EXE
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000055000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\APPDATA\ROAMING\DNSPY\DNSPY.XMLC:\USERS\user\APPDATA\ROAMING\DNSPY\DNSPY.XMLC:\PROGRAM FILES\WIRESHARK\WIRESHARK.EXEC:\PROGRAM FILES\WIRESHARK\WIRESHARK.EXEC:\PROGRAM FILES\SYSINTERNALS SUITE\PROCEXP.EXEC:\PROGRAM FILES\SYSINTERNALS SUITE\PROCEXP.EXEC:\PROGRAM FILES (X86)\FIDDLER\FIDDLER.EXEC:\PROGRAM FILES (X86)\FIDDLER\FIDDLER.EXEPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPROXIMATELY 10 MF67B1E455C5BCPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPROXIMATELY 10 MI67B1E455C5BC4PLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPROXIMATELY 10 MIN7B1E455C5BC49P
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000086000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MAEL HORZ\HXD HEX EDITOR\HXD HEX EDITOR.LMAEL HORZ\HXD HEX EDITOR\HXD HEX EDITOR.LAMAEL HORZ\HXD HEX EDITOR\HXD HEX EDITOR.LANMAEL HORZ\HXD HEX EDITOR\HXD HEX EDITOR.LANGPROGRAMFILES(X86)C:\PROGRAM FILES (X86)\FIDDLER\FIDDLER.EXE9E146BE9-C76A-4720-BCDB-53011B87BD069E146BE9-C76A-4720-BCDB-53011B87BD06-EWE'RET
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C0003E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IDA PRO\IDAQ.EXIDA PRO\IDAQ.EXEP
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\IDA PRO\IDAQ.EXE
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @OFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXE0OFFICECLICKTORUN.EXE0BOFFICECLICKTORUN.EXE0B4OFFICECLICKTORUN.EXE0B4-OFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXE0OFFICECLICKTORUN.EXE0BOFFICECLICKTORUN.EXE0B4OFFICECLICKTORUN.EXE0B4-OFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXE0OFFICECLICKTORUN.EXE0BOFFICECLICKTORUN.EXE0B4OFFICECLICKTORUN.EXE0B4-OFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXE0OFFICECLICKTORUN.EXE0BOFFICECLICKTORUN.EXE0B4OFFICECLICKTORUN.EXE0B4-1.3.6.1.5.5.7.3.11.3.6.1.5.5.7.3.21.3.6.1.5.5.7.3.31.3.6.1.5.5.7.3.41.3.6.1.5.5.7.3.51.3.6.1.5.5.7.3.61.3.6.1.5.5.7.3.71.3.6.1.5.5.7.3.81.3.6.1.5.5.7.3.91.3.6.1.4.1.311.10.3.32.16.840.1.113730.4.11.3.6.1.4.1.311.2.1.221.3.6.1.4.1.311.61.1.1OFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXE0OFFICECLICKTORUN.EXE00OFFICECLICKTORUN.EXE000OFFICECLICKTORUN.EXE0000OFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXEOFFICECLICKTORUN.EXECOFFICECLICKTORUN.EXEC0OFFICECLICKTORUN.EXEC00RDG PACKER DETECTOR-C000RDG PACKER DETECTORRDG PACKER DETECTORRDG PACKER DETECTORRDG PACKER DETECTOR-RDG PACKER DETECTOR-CRDG PACKER DETECTOR-C0RDG PACKER DETECTOR-C00RDG PACKER DETECTOR-C000RDG PACKER DETECTORRDG PACKER DETECTORRDG PACKER DETECTORRDG PACKER DETECTOR-RDG PACKER DETECTOR-CRDG PACKER DETECTOR-C0RDG PACKER DETECTOR-C00RDG PACKER DETECTOR-C000RDG PACKER DETECTORRDG PACKER DETECTORRDG PACKER DETECTORRDG PACKER DETECTOR-RDG PACKER DETECTOR-BRUNTIMEBROKER.EXE1A-B6RUNTIMEBROKER.EXE1A-B69RUNTIMEBROKER.EXE1A-B69CRUNTIMEBROKER.EXERUNTIMEBROKER.EXE1RUNTIMEBROKER.EXE1ARUNTIMEBROKER.EXE1A-RUNTIMEBROKER.EXE1A-BRUNTIMEBROKER.EXE1A-B6PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_IDENTIFIER=INTEL64 FAMILY 6 MODEL 143 STEPPING 8, GENUINEINTELC:\USERS\user\APPDATA\LOCAL\DNSPYC:\USERS\user\APPDATA\ROAMING\MAEL HORZ\HXD HEX EDITOR\HXD HEX EDITOR.INIC:\USERS\user\APPDATA\ROAMING\MAEL HORZ\HXD HEX EDITOR\HXD HEX EDITOR.LANGC:\PROGRAM FILES\OLLYDBG\OLLYDBG.INIC:\PROGRAM FILES\OLLYDBG\OLLYDBG.INI++--/9==AZ__AZ\|\|++--/9==AZ__AZ\|\|C:\PROGRAM FILES\GHIDRA\GHIDRARUN.BATC:\PROGRAM FILES\GHIDRA\GHIDRARUN.BATC:\PROGRAM FILES\IDA PRO\IDAQ.EXEC:\PROGRAM FILES\IDA PRO\IDAQ.EXE9E146BE9-C76A-4720-BCDB-53011B87BD069E146BE9-C76A-4720-BCDB-53011B87BD06PLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPRPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPROPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPROXPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPROXIPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROCESS WILL TAKE APPROXIMPLEASE
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK\WIRESHATWIRESHARK\WIRESHARWIRESHARK\WIRESHARKWIRESHARK\WIRESHARK.WIRESHARK\WIRESHARK.EWIRESHARK\WIRESHARK.EXWIRESHARK\WIRESHARK.EXESYSINTERNALS SUITWIN32_SYSINTERNALS SUITEIN32_BSYSINTERNALS SUITE\SSYSINTERNALS SUITE\PSYSINTERNALS SUITE\PRSYSINTERNALS SUITE\PROSYSINTERNALS SUITE\PROCSYSINTERNALS SUITE\PROCETOTALPHYSICALMEMOTOTALPHYSICALMEMORTOTALPHYSICALMEMORYCONTROL PANEL\INTCONTROL PANEL\INTECONTROL PANEL\INTERCONTROL PANEL\INTERNCONTROL PANEL\INTERNACONTROL PANEL\INTERNATCONTROL PANEL\INTERNATICONTROL PANEL\INTERNATIOFIDDLER\FIDDLER.EFIDDLER\FIDDLER.EXFIDDLER\FIDDLER.EXEPROGRAMFILES(X86)C:\PROGRAM FILES (X86)C:\PROGRAM FILES (X86)\GHIDRA\GHIDRARUN.GHIDRA\GHIDRARUN.B
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK\WIRESHARK.EXE
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\WIRESHARK\WIRESHARK.EXE
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ZWFLUSHBUFFERSFIZWFLUSHBZWFLUSHIZWFLUSHBUFFERSFIZWFLUSHINSTALLUIZWFLUSHIZWFLUSHKZWFLUSHINSTRUCTIC:\USERS\user\APPDATA\ROAMING\DNSPY\DNSPY.XMLC:\USERS\user\APPDATA\LOCAL\DNSPYC:\USERS\user\APPDATA\ROAMING\PROCESS HACKER 2\SETTINGS.XMLC:\USERS\user\APPDATA\ROAMING\PROCESS HACKER 2\USERNOTESDB.XMLC:\PROGRAM FILES\OLLYDBG\OLLYDBG.INIC:\PROGRAM FILES\WIRESHARK\WIRESHARK.EXEC:\PROGRAM FILES\SYSINTERNALS SUITE\PROCEXP.EXEC:\PROGRAM FILES\GHIDRA\GHIDRARUN.BATC:\PROGRAM FILES\IDA PRO\IDAQ.EXEC:\USERS\user\IEINSPECTORC:\USERS\user\IEINSPECTORSOFTWARE\MICROSOFT\CRYPTOGRAPHY9E146BE9-C76A-4720-BCDB-53011B87BD06-GWD56MQDDMEPSOFTWARE\MICROSOFT\CRYPTOGRAPHYSOFTWARE\9E146BE9-C76A-4720-BCDB-53011B87BD06-QUDXBUV1JXXHPLEASE WAIT WHILE YOUR BROWSER UPDATES. THIS PROC

Source: C:\Users\user\Desktop\BrowserUpdate.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: BrowserUpdate.exe	Binary or memory string: detects_vmware
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: GVMwareG
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Mvmx86M
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServiceMute
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuest
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGues
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VHyper-VOMxO
Source: BrowserUpdate.exe	Binary or memory string: 7zXZ\SystemRoot\Device\0123456789ABCDEF0123456789abcdefpea_epscn_islastpea_epcallnextpea_secmissizepea_epatstartlastsectpea_entrybyte60pea_entrybyte90pea_epiniatpea_usesuninitializedregspea_prefetchtrickspea_issuspiciouspea_isgenericpea_isreportedpea_aggressiveimportpea_enable_binlibpea_enable_lshashpea_many_importspea_self_modifying_codepea_track_direct_importspea_detects_vmpea_detects_vmwarepea_detects_virtualpcpea_is_delphipea_uses_single_steppingpea_uses_bound_exceptionspea_uses_div_by_zeropea_uses_int_overflowpea_uses_invalid_opcodespea_uses_unusual_breakpointpea_checks_if_debugged_documentedpea_disable_io_redirectionpea_suspicious_rebasepea_disable_drop_mz_onlypea_suspicious_stack_geometrypea_suspicious_subsystempea_suspicious_timestamppea_suspicious_valignpea_suspicious_section_fsizepea_suspicious_section_characteristicspea_aggressive_trim_wspea_16bitmachinepea_system_filepea_suspicious_number_of_dirspea_force_unpackingpea_extended_pestaticpea_small_data_directory_countpea_multiple_relocs_same_locationpea_relocs_but_no_relocs_flagpea_suspicious_imagebasepea_no_section_tablepea_no_sectionspea_many_sectionspea_suspicious_image_sizepea_bound_imports_inside_imagepea_delay_load_imports_inside_imagepea_entrypoint_in_import_tablepea_entrypoint_in_headerpea_import_via_tlspea_epsec_not_executablepea_othermachine_imagepea_checks_teb_lasterrorpea_disable_vmprotectpea_checks_teb_laststatuspea_disable_thread_apicall_limitpea_deep_apicall_limitpea_dynmem_uses_div_by_zeropea_dynmem_uses_int_overflowpea_dynmem_uses_bound_exceptionspea_dynmem_uses_privinstrpea_dynmem_uses_breakpointspea_dynmem_uses_single_steppingpea_dynmem_uses_invalid_opcodespea_dynmem_uses_unusual_breakpointpea_dynmem_detects_vmpea_dynmem_detects_vmwarepea_dynmem_detects_virtualpcpea_dynmem_checks_if_debugged_docpea_dynmem_checks_if_debugged_undocpea_dynmem_kernel_scanpea_dynmem_self_modifying_codepea_dt_continue_after_unpackingpea_dt_continue_after_unpacking_damagedpea_loop_jmp_chainpea_droppedpea_reads_vdll_codepea_dynmem_reads_vdll_codepea_verbose_vdll_readspea_scan_internal_datapea_isvbpcodepea_ARM_legacypea_ARM_big_endianpea_ARM_unpredictablepea_isappcontainerpea_checks_ntglobalflagpea_dynmem_checks_ntglobalflagpea_dynmem_checks_processheappea_dt_error_heur_exit_criteriapea_dt_error_too_many_prefixespea_dt_error_invalid_opcodepea_dt_error_too_many_operandspea_dt_error_bb_limitpea_dt_error_loop_too_complexpea_executes_from_last_sectionpea_executes_from_resourcespea_memory_patchedpea_uses_sysenterpea_suspicious_resource_directory_sizepea_suspicious_import_directory_sizepea_invalid_ilt_entrypea_dmg_machinepea_dmg_filealignmentpea_dmg_pointertorawdatapea_dmg_virtualaddresspea_dmg_truncatedpea_dmg_special_sectionpea_dmg_relocationspea_dmg_overlapping_sectionspea_dmg_optional_magicpea_dmg_sizeofheaderspea_dmg_imagebasepea_dmg_imagesizepea_dmg_unsupportedpea_dmg_importspea_dmg_invaliddatapea_dmg_decompresspea_dmg_virtualsizepea_dmg_not_executable_imagepea_dmg_entrypointpea_inv_sizeofoptio
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmx86Mute
Source: BrowserUpdate.exe	Binary or memory string: pea_detects_vmware
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: AHJNPZAHJNPZGoogle-Cloud-PlatfGoogle-Cloud-PlatfoGoogle-Cloud-PlatforGoogle-Cloud-PlatformAkamai TechnologiAkamai Technologie3-999FAkamai TechnologiesAkamai Internatioo Akamai Internation mAkamai InternationamaAkamai InternationalapAkamai International p Akamai International B sAkamai International B.1Akamai International B.VMICROSOFT-CORP-MSo MICROSOFT-CORP-MSN mMICROSOFT-CORP-MSN-maMICROSOFT-CORP-MSN-AapMICROSOFT-CORP-MSN-ASp MICROSOFT-CORP-MSN-AS- oMICROSOFT-CORP-MSN-AS-BEMICROSOFT-CORP-MSN-AS-BLCentripetal Netwo tCentripetal NetwortyCentripetal NetworkypCentripetal NetworkspeCheck Point Softw type Check Point Softwatype fCheck Point Softwar-A8B3Check Point SoftwareCheck Point Software Check Point Software TCheck Point Software TeCheck Point Software TecCrowdStrike Falcof arraCrowdStrike Falcon arrayFidelis Cybersecu50-9157Fidelis Cybersecur404 page not foundFidelis CybersecuriFidelis CybersecuritFidelis CybersecurityMICROSOFT-CORP-MSN-w9EMICROSOFT-CORP-MSN-AeEFMICROSOFT-CORP-MSN-ASdF6405 method not allowedGetUserDefaultLCIDMICROSOFT-CORP-MSN-AS-MICROSOFT-CORP-MSN-AS-BMICROSOFT-CORP-MSN-AS-BLMicrosoft SysinteMicrosoft SysinterMicrosoft SysinternTimVariantTimeToSystemTimeSysAllocStringLenMicrosoft SysinternaCreateDispTypeInfoCreateStdDispatchMicrosoft SysinternalMicrosoft SysinternalsSafeArrayAccessDataPalo Alto Networkb-a7SafeArrayAllocDataPalo Alto Networks-a73Palo Alto Networks a733Palo Alto Networks C733-Palo Alto Networks CoPalo Alto Networks CorPalo Alto Networks CortPalo Alto Networks CorteSafeArrayAllocDescriptorSplunk Enterpriset\CrSplunk Enterprise \CrySplunk Enterprise SCrypSplunk Enterprise SeryptSplunk Enterprise SecSplunk Enterprise SecuSplunk Enterprise SecurSplunk Enterprise SecuriSafeArrayCopyDataSafeArrayCreateExTrustwave SpiderLt\CTrustwave SpiderLa\CrTrustwave SpiderLabCryTrustwave SpiderLabsrypSafeArrayCreateVectorVirusTotal Jujubot\CryptVirusTotal JujuboxidWatchGuard TechnoWatchGuard TechnoltoWatchGuard TechnoloorWatchGuard TechnologrESafeArrayCreateVectorExWatchGuard TechnologiWatchGuard TechnologieWatchGuard TechnologiesSafeArrayDestroyDataWhiteHat Securityt\CrypMicrosoftVirtualPt\CryptMicrosoftVirtualPCidMicrosoftVirtualPC7cMicrosoftVirtualPC7UrMicrosoftVirtualPC7UsiMicrosoftVirtualPC7UsepMicrosoftVirtualPC7UsertMicrosoftVirtualPC7UserSSandboxie_SingleIt\CrypSafeArrayGetElementSandboxie_SingleIn\CryptSandboxie_SingleInsdSandboxie_SingleInstSafeArrayGetElemsizeSandboxie_SingleInstaSafeArrayGetLBoundSandboxie_SingleInstanSafeArrayGetUBoundSandboxie_SingleInstancSandboxie_SingleInstanceSafeArrayGetVartypeSBIE_BOXED_Servict\CrySBIE_BOXED_Service\CrypSafeArrayPtrOfIndexSBIE_BOXED_ServiceICryptSBIE_BOXED_ServiceIndSBIE_BOXED_ServiceIniSBIE_BOXED_ServiceInitSafeArrayUnaccessDataSBIE_BOXED_ServiceInitCSBIE_BOXED_ServiceInitCoSafeArrayPutElementCuckooSpoolerSectCuckooSpoolerSectiCuckooSpoolerSectioCuckooSpoolerSectionCuckooRegistryStadInfSafeArrayGetRecordInfoCuckooRegistryStarCuckooRegistryStartCuckooRegistryStartuCuckooRegistr
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestS
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tPVBoxTrayIP.xml
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RQEMU
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tvmx86Mut
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 5image/jxrVMWare
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmx86Mut
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: eVMwareGue
Source: BrowserUpdate.exe	Binary or memory string: azurevirtualmachinename_scrubbed
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VBoxTrayIPC
Source: BrowserUpdate.exe	Binary or memory string: VMwareVMware
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmx86Mu
Source: BrowserUpdate.exe	Binary or memory string: azurevirtualmachinename
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServiceMutex
Source: BrowserUpdate.exe	Binary or memory string: Unknown member: peattributes.%hspe.set_peattribute(name, state) expects boolean "state"ARM_big_endianARM_legacyARM_unpredictable_16bitmachine_32bitmachineaggressive_trim_wsaggressiveimportamd64_imagearm_imageaslr_bit_setbound_imports_inside_imagebyte_reversed_hibyte_reversed_lowcalls_unimplemented_apichecks_if_debugged_documentedchecks_if_debugged_undocumentedchecks_ntglobalflagchecks_processheapchecks_teb_lasterrorchecks_teb_laststatuscode_on_stackdebug_strippeddeep_analysisdeep_apicall_limitdelay_load_imports_inside_imagedetects_virtualpcdetects_vmdetects_vmwaredirty_wx_branchdisable_apicall_limitdisable_drop_mz_onlydisable_dropper_rescandisable_io_redirectiondisable_microcodedisable_seh_limitdisable_static_unpackingdisable_thread_apicall_limitdisable_vmprotectdmg_decompressdmg_entrypointdmg_filealignmentdmg_imagebasedmg_imagesizedmg_importsdmg_invaliddatadmg_machinedmg_not_executable_imagedmg_notcontiguousdmg_optional_magicdmg_overlapping_sectionsdmg_pointertorawdatadmg_relocationsdmg_resource_levelsdmg_resource_namesdmg_resource_offsetdmg_resource_unordereddmg_sectionalignmentdmg_sizeofheadersdmg_sizeofrawdatadmg_special_sectiondmg_truncateddmg_unsupporteddmg_virtualaddressdmg_virtualsizedroppeddt_continue_after_unpackingdt_continue_after_unpacking_damageddt_error_bb_limitdt_error_failed_to_translatedt_error_heur_API_limitdt_error_heur_exit_criteriadt_error_invalid_opcodedt_error_loop_too_complexdt_error_not_enough_memorydt_error_too_many_operandsdt_error_too_many_prefixesdt_error_vmm_page_faultdynmem_APIcalldynmem_checks_if_debugged_docdynmem_checks_if_debugged_undocdynmem_checks_ntglobalflagdynmem_checks_processheapdynmem_detects_virtualpcdynmem_detects_vmdynmem_detects_vmwaredynmem_kernel_scandynmem_reads_vdll_codedynmem_self_modifying_codedynmem_uses_access_violationdynmem_uses_bound_exceptionsdynmem_uses_breakpointsdynmem_uses_div_by_zerodynmem_uses_int_overflowdynmem_uses_invalid_opcodesdynmem_uses_privinstrdynmem_uses_single_steppingdynmem_uses_udbgrddynmem_uses_udbgwrdynmem_uses_unusual_breakpointenable_binlibenable_lshashenable_vmm_growentrybyte55entrybyte60entrybyte90entrypoint_in_headerentrypoint_in_import_tableepatscnstartepatstartentrysectepatstartlastsectepcallnextepinfirstsectepiniatepoutofimageepscn_eqsizesepscn_falignepscn_islastepscn_valignepscn_vfalignepscn_writableepsec_not_executableexecutable_imageexecutble_imageexecutes_from_dynamic_memoryexecutes_from_last_sectionexecutes_from_resourcesextended_pestaticfirstsectwritableforce_dtforce_expensive_processingforce_unpackinggenpackedhandle_large_vahas_checksumhas_delay_load_importshas_many_resourceshas_msilresourceshasappendeddatahasboundimportshasexportshasstandardentryheaderchecksum0hstr_exhaustiveia64_imageimport_via_tlsinv_argumentsinv_datainv_decompress_errorinv_dos_signatureinv_e_lfanewinv_exportsinv_fileinv_filealignmentinv_filesizeinv_imagebaseinv_nomemoryinv_notimplementedinv_nt_signatureinv_optional_magicinv_overlappinginv_rawoffsetinv_rawsizeinv_readinv_rvainv_sect
Source: BrowserUpdate.exe	Binary or memory string: dynmem_detects_vmware
Source: BrowserUpdate.exe	Binary or memory string: Software\Microsoft\Windows DefenderSOFTWARE\Policies\Microsoft\SQMClient\WindowsPhoneSoftware\Policies\Microsoft\SQMClient%windir%\temp%ProgramFiles(x86)%NtGetCachedSigningLevelSOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlockhr=0x%08XThreatTrackingSigSeqEmuldet.Ainvalid hash bucket count&
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServiceMo
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 6vmx86
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CuckooRegistryStartupMutVMwareGuestServicc
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServVMwareGuestServiaudio/x-wavsectools
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGu
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestSeVMwareGuestServ
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VBoxTray
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VBoxTrayI
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: aVMwareGuestVMwareGuestS
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServiaudio/x-wav
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServ
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: eVMware
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestSer
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: sVMwareGuesaudio/wav
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestSe
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Kaudio/vnd.wavevmx86Mutevmx86Mutex
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGue
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmx86M
Source: BrowserUpdate.exe, 00000000.00000002.2202298161.00000280ADC72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmx86Mutex
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: yVBoxTray
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServicet
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareG
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: uvmx86Mu
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmx86
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServiceMut
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareGuestServiceMur
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VBoxTrayIP
Source: BrowserUpdate.exe	Binary or memory string: pea_dynmem_detects_vmware
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000428000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IVBoxTrayI

Source: C:\Users\user\Desktop\BrowserUpdate.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\BrowserUpdate.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\BrowserUpdate.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\BrowserUpdate.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\BrowserUpdate.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\BrowserUpdate.exe	NtQueryInformationProcess: Indirect: 0x7FF7E56C8F92	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	NtSetInformationThread: Indirect: 0x7FF7E56D8A31	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	NtQueryInformationProcess: Indirect: 0x7FF7E56DC5D4	Jump to behavior
Source: C:\Users\user\Desktop\BrowserUpdate.exe	NtQuerySystemInformation: Indirect: 0x7FF7E5672B55	Jump to behavior

Source: C:\Users\user\Desktop\BrowserUpdate.exe

Queries volume information: C:\Users\user\Desktop\BrowserUpdate.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\BrowserUpdate.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Sysinternals Suite\procexp.exe
Source: BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Wireshark\Wireshark.exe
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Sysinternals Suite\procexp.exe
Source: BrowserUpdate.exe, 00000000.00000002.2199876221.000000C000257000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Wireshark\Wireshark.exe

Stealing of Sensitive Information

Yara detected MicroClip

Source: Yara match	File source: BrowserUpdate.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.2205746713.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2108717389.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BrowserUpdate.exe PID: 1220, type: MEMORYSTR

Remote Access Functionality

Yara detected MicroClip

Source: Yara match	File source: BrowserUpdate.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.2205746713.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2108717389.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BrowserUpdate.exe PID: 1220, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	32 Virtualization/Sandbox Evasion	11 Input Capture	731 Security Software Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Software Packing	LSASS Memory	32 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	113 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BrowserUpdate.exe	3%	ReversingLabs
BrowserUpdate.exe	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
15.164.165.52.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
https://pkg.go.dev/github.com/gin-gonic/gin#readme-don-t-trust-all-proxies	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflict%s%sthis%s	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://crashpad.chromium.org/bug/new	0%	Avira URL Cloud	safe
https://crashpad.chromium.org/	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflict%s%sthis%s	0%	Virustotal		Browse
https://crashpad.chromium.org/	0%	Virustotal		Browse
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	0%	Avira URL Cloud	safe
http://.ocx.cabhtml:file::LowTelemetry	0%	Avira URL Cloud	safe
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web	1%	Virustotal		Browse
https://crashpad.chromium.org/bug/new	0%	Virustotal		Browse
https://github.com/gin-gonic/gin/blob/master/docs/doc.md#dont-trust-all-proxies	0%	Avira URL Cloud	safe
https://pkg.go.dev/github.com/gin-gonic/gin#readme-don-t-trust-all-proxies	0%	Virustotal		Browse
http://www.opengis.net/gml	0%	Avira URL Cloud	safe
http://www.collada.org/2005/11/COLLADASchema	0%	Avira URL Cloud	safe
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	0%	Virustotal		Browse
http://www.topografix.com/GPX/1/1	0%	Avira URL Cloud	safe
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=webreferrerEvalError	0%	Avira URL Cloud	safe
http://www.opengis.net/gml	0%	Virustotal		Browse
https://m.google.com/devicemanagement/data/api	0%	Avira URL Cloud	safe
http://www.topografix.com/GPX/1/1	0%	Virustotal		Browse
http://earth.google.com/kml/2.2	0%	Avira URL Cloud	safe
http://www.collada.org/2005/11/COLLADASchema	0%	Virustotal		Browse
http://earth.google.com/kml/2.0	0%	Avira URL Cloud	safe
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtdWarning:	0%	Avira URL Cloud	safe
https://dl.google.com/update2/installers/icons/	0%	Avira URL Cloud	safe
http://earth.google.com/kml/2.1	0%	Avira URL Cloud	safe
https://m.google.com/devicemanagement/data/api	0%	Virustotal		Browse
http://earth.google.com/kml/2.2	0%	Virustotal		Browse
http://earth.google.com/kml/2.0	0%	Virustotal		Browse
http://support.google.com/installer/	0%	Avira URL Cloud	safe
https://github.com/gin-gonic/gin/blob/master/docs/doc.md#dont-trust-all-proxies	0%	Virustotal		Browse
http://www.opengis.net/gml/3.2	0%	Avira URL Cloud	safe
http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2	0%	Avira URL Cloud	safe
https://dl.google.com/update2/installers/icons/	0%	Virustotal		Browse
http://support.google.com/installer/%s?product=%s&error=%d	0%	Avira URL Cloud	safe
http://www.opengis.net/kml/2.2	0%	Avira URL Cloud	safe
http://www.opengis.net/gml/3.2	0%	Virustotal		Browse
http://earth.google.com/kml/2.1	0%	Virustotal		Browse
http://www.opengis.net/gml/3.3/exr	0%	Avira URL Cloud	safe
http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2	0%	Virustotal		Browse
http://.jpg	0%	Avira URL Cloud	safe
http://wails.localhost/runtime.WindowReload();msSmartScreenProtection-//ietf//dtd	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest	0%	Avira URL Cloud	safe
http://www.opengis.net/kml/2.2	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest	0%	Virustotal		Browse
http://www.opengis.net/gml/3.3/exr	0%	Virustotal		Browse
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtdWarning:	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
15.164.165.52.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
https://crashpad.chromium.org/	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pkg.go.dev/github.com/gin-gonic/gin#readme-don-t-trust-all-proxies	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	BrowserUpdate.exe	false	URL Reputation: safe	unknown
https://crashpad.chromium.org/bug/new	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://protobuf.dev/reference/go/faq#namespace-conflict%s%sthis%s	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://.css	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web	BrowserUpdate.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://.ocx.cabhtml:file::LowTelemetry	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
https://github.com/gin-gonic/gin/blob/master/docs/doc.md#dont-trust-all-proxies	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.opengis.net/gml	BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000496000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.collada.org/2005/11/COLLADASchema	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.topografix.com/GPX/1/1	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=webreferrerEvalError	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
https://m.google.com/devicemanagement/data/api	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://earth.google.com/kml/2.2	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://earth.google.com/kml/2.0	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtdWarning:	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dl.google.com/update2/installers/icons/	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://earth.google.com/kml/2.1	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://support.google.com/installer/	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
http://www.opengis.net/gml/3.2	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.garmin.com/xmlschemas/TrainingCenterDatabase/v2	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://support.google.com/installer/%s?product=%s&error=%d	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
http://www.opengis.net/kml/2.2	BrowserUpdate.exe, 00000000.00000002.2201160563.000000C000496000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	BrowserUpdate.exe	false	URL Reputation: safe	unknown
http://www.opengis.net/gml/3.3/exr	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://.jpg	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
http://wails.localhost/runtime.WindowReload();msSmartScreenProtection-//ietf//dtd	BrowserUpdate.exe	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest	BrowserUpdate.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.3.19.110	unknown	Denmark		2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1472046
Start date and time:	2024-07-12 08:41:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BrowserUpdate.exe
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ocsps.ssl.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARNES-NETAcademicandResearchNetworkofSloveniaSI	https://disk.yandex.ru/d/ArN8zL4WbJeexQ	Get hash	malicious	Panda Stealer	Browse	193.3.184.24
	http://atthespace.org	Get hash	malicious	Phisher	Browse	193.3.19.51
	g5ns2jpAyk.elf	Get hash	malicious	Mirai	Browse	95.87.151.72
	https://angkorvilla.net/dzv3n	Get hash	malicious	Phisher	Browse	193.3.19.67
	RsxXCSXOUK.elf	Get hash	malicious	Unknown	Browse	141.255.194.243
	QJP0ekw0wX.elf	Get hash	malicious	Mirai	Browse	95.87.151.88
	HHzrOvo2d3.elf	Get hash	malicious	Unknown	Browse	109.127.255.133
	iFTZfjcn8I.elf	Get hash	malicious	Mirai	Browse	95.87.151.61
	http://ageofimmortalsgame.com/wth1u	Get hash	malicious	Phisher	Browse	193.3.19.67
	http://wwwlegals.com	Get hash	malicious	Unknown	Browse	193.3.17.197

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.431534949992998
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	BrowserUpdate.exe
File size:	55'469'264 bytes
MD5:	696b3679926998b45c806a1068ffcb75
SHA1:	87a680e3018d3604eea9b1d28915fac5172f30df
SHA256:	393b1fdda7c4af084743c56c27585366567a8446c6438753d20b0b9ee3e72541
SHA512:	1026d0ef5e716c2c85db3c42db300d6312bba3ff86f7f7b8d071903725702b9d0601eea15c05f5173a147c95e3263d0c15280fea3984fb14070f07a592b5942c
SSDEEP:	393216:4Om6IAUAYVtWlwRJtmWYAosedwrsUbX1YcWxAnwt6Csu5h4Lj92HygC5Ou2hFJ4d:kA7Yr6wRJtmdDQo0urM5NQTng
TLSH:	C3C77DD3B5D541E8C0AAD138C622A72BEA6F3C694B3193C72660B6551F33BD07E39B11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................&......y.....n..........@..............................U.....e.N...`... ............................

File Icon


Icon Hash:	2f232d67b7934633

Static PE Info

General

Entrypoint:	0x14304ee6e
Entrypoint Section:	rcdata
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	0d54db7fa2e518e83dc2999e4a3a4172

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	04/07/2024 09:15:01 04/07/2025 06:27:09
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization, CN="Hebei Yingtong Pipeline Co., Ltd.", SERIALNUMBER=91130900335872388P, O="Hebei Yingtong Pipeline Co., Ltd.", L=Cangzhou, S=Hebei, C=CN
Version:	3
Thumbprint MD5:	3AFEC48ADFA00ED083999F0A15FE4EE8
Thumbprint SHA-1:	B8B63B45242CF37561729AA4CB601CFE67E9DBFA
Thumbprint SHA-256:	D592E1FD6B5E33BF819D4A0CBE876A3E9BE9A3621B9EAF29A7BA5A11A3A6084C
Serial:	7F71AF692330002E03E1311EB8A8B7E0

Entrypoint Preview

Instruction
push ebp
jmp 00007F3BF8E32689h
push ds

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x280d000	0x90	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x280e041	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1161000	0x16abd9c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x34c202c	0x2dbc4	rcdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x34e3a10	0x2ac0	rcdata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3558000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x280f028	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x87e5a0	0x87e600	9821f15ae7a9feb3a30733fe24160eea	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x880000	0x1f75c0	0x1f7600	aa1e75b8d62089e4350caf78c21cbac4	False	0.786530276105041	data	7.390200108113139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa78000	0x6261c0	0x626200	1fe75010522fe6a2f13cb2f6212fe231	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x109f000	0x2db58	0x2dc00	85be5361647e955e87e44d1e45e1a2ff	False	0.3962015454234973	data	5.966601038201182	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x10cd000	0xb54	0xc00	0d25e2f0db23d742779ce3e1900ef897	False	0.318359375	data	4.488149387638767	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x10ce000	0x6a24c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x1139000	0x90	0x200	cd2068c6f2aa9c77a6abe858b5a07682	False	0.228515625	data	1.8867632120161382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x113a000	0xdf8	0xe00	a2a4fcf66d1d2188b42bad7c4cfd4288	False	0.07310267857142858	data	2.033612510254921	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x113b000	0x68	0x200	44ce2550ca16ee5376997fbcd1c20370	False	0.076171875	data	0.3772912244293227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x113c000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x113d000	0x235e4	0x23600	e84c6500c9b9ffa342c9b6092af1c2e1	False	0.1652633613074205	data	5.4366798680078565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x1161000	0x16abd9c	0x16abe00	6b78a59f340bc33880fcf41f134c8686	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.edata	0x280d000	0x1000	0x200	4a0919c9e141a2fa0b96d2ee89909b0f	False	0.228515625	data	1.8978833165347773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x280e000	0x1000	0x200	efe9eb225d5565642bce4f5387c75daf	False	0.18359375	data	1.335140452532977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x280f000	0x1000	0x200	e3c090febbdaf85bedd0e41c83696313	False	0.052734375	data	0.32010974348767507	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rcdata	0x2810000	0xd48000	0xd48000	9997b28a865f1371358d1c41fe909f80	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3558000	0x1000	0x10	63ca11e0e96710bc9f098e98c47f9119	False	1.5	GLS_BINARY_LSB_FIRST	3.0	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
B7	0x1169278	0x46923a	7-zip archive data, version 0.4	English	United States	0.5025863647460938
BINARY	0x15d24b4	0x1046a08	PE32+ executable (DLL) (console) x86-64, for MS Windows			0.5078086853027344
BINARY	0x2618ebc	0x97c38	PE32+ executable (DLL) (console) x86-64, for MS Windows			0.48935208421811255
RT_BITMAP	0x26b0af4	0x1b38	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Arabic	Saudi Arabia	0.46426521239954077
RT_BITMAP	0x26b262c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Chinese	Taiwan	0.4626006904487917
RT_BITMAP	0x26b4154	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Czech	Czech Republic	0.4626006904487917
RT_BITMAP	0x26b5c7c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Danish	Denmark	0.4626006904487917
RT_BITMAP	0x26b77a4	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	German	Germany	0.4626006904487917
RT_BITMAP	0x26b92cc	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Greek	Greece	0.4626006904487917
RT_BITMAP	0x26badf4	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	English	United States	0.4626006904487917
RT_BITMAP	0x26bc91c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Finnish	Finland	0.4626006904487917
RT_BITMAP	0x26be444	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	French	France	0.4626006904487917
RT_BITMAP	0x26bff6c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Hebrew	Israel	0.4626006904487917
RT_BITMAP	0x26c1a94	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Hungarian	Hungary	0.4626006904487917
RT_BITMAP	0x26c35bc	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Italian	Italy	0.4626006904487917
RT_BITMAP	0x26c50e4	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Japanese	Japan	0.4626006904487917
RT_BITMAP	0x26c6c0c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Korean	North Korea	0.4626006904487917
RT_BITMAP	0x26c6c0c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Korean	South Korea	0.4626006904487917
RT_BITMAP	0x26c8734	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Dutch	Netherlands	0.4626006904487917
RT_BITMAP	0x26ca25c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Norwegian	Norway	0.4626006904487917
RT_BITMAP	0x26cbd84	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Polish	Poland	0.4626006904487917
RT_BITMAP	0x26cd8ac	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Portuguese	Brazil	0.4626006904487917
RT_BITMAP	0x26cf3d4	0x1b48	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Russian	Russia	0.4667812142038946
RT_BITMAP	0x26d0f1c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Swedish	Sweden	0.4626006904487917
RT_BITMAP	0x26d2a44	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Turkish	Turkey	0.4626006904487917
RT_BITMAP	0x26d456c	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Chinese	China	0.4626006904487917
RT_BITMAP	0x26d6094	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m	Portuguese	Portugal	0.4626006904487917
RT_BITMAP	0x26d7bbc	0x1b28	Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m			0.4626006904487917
RT_ICON	0x26d96e4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colors	English	United States	0.6317567567567568
RT_ICON	0x26d980c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.5823699421965318
RT_ICON	0x26d9d74	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colors	English	United States	0.5120967741935484
RT_ICON	0x26da05c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5455776173285198
RT_ICON	0x26da904	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.36341463414634145
RT_ICON	0x26daf6c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.42350746268656714
RT_DIALOG	0x26dbe14	0x1ea	data	Arabic	Saudi Arabia	0.5530612244897959
RT_DIALOG	0x26dc000	0x128	data	Chinese	Taiwan	0.6993243243243243
RT_DIALOG	0x26dc128	0x1e8	data	Czech	Czech Republic	0.569672131147541
RT_DIALOG	0x26dc310	0x23a	data	Danish	Denmark	0.5263157894736842
RT_DIALOG	0x26dc54c	0x1f2	data	German	Germany	0.572289156626506
RT_DIALOG	0x26dc740	0x222	data	Greek	Greece	0.5494505494505495
RT_DIALOG	0x26dc964	0x1e4	data	English	United States	0.5516528925619835
RT_DIALOG	0x26dcb48	0x200	data	Finnish	Finland	0.53125
RT_DIALOG	0x26dcd48	0x230	data	French	France	0.5178571428571429
RT_DIALOG	0x26dcf78	0x1d4	data	Hebrew	Israel	0.5769230769230769
RT_DIALOG	0x26dd14c	0x22a	data	Hungarian	Hungary	0.5216606498194946
RT_DIALOG	0x26dd378	0x236	data	Italian	Italy	0.47703180212014135
RT_DIALOG	0x26dd5b0	0x158	data	Japanese	Japan	0.7267441860465116
RT_DIALOG	0x26dd708	0x14e	data	Korean	North Korea	0.6586826347305389
RT_DIALOG	0x26dd708	0x14e	data	Korean	South Korea	0.6586826347305389
RT_DIALOG	0x26dd858	0x27c	data	Dutch	Netherlands	0.46540880503144655
RT_DIALOG	0x26ddad4	0x1fe	data	Norwegian	Norway	0.5490196078431373
RT_DIALOG	0x26ddcd4	0x240	data	Polish	Poland	0.5173611111111112
RT_DIALOG	0x26ddf14	0x232	data	Portuguese	Brazil	0.5355871886120996
RT_DIALOG	0x26de148	0x20e	data	Russian	Russia	0.5285171102661597
RT_DIALOG	0x26de358	0x1e4	data	Swedish	Sweden	0.5681818181818182
RT_DIALOG	0x26de53c	0x21a	data	Turkish	Turkey	0.5669144981412639
RT_DIALOG	0x26de758	0x126	data	Chinese	China	0.717687074829932
RT_DIALOG	0x26de880	0x228	data	Portuguese	Portugal	0.5307971014492754
RT_DIALOG	0x26deaa8	0x246	data			0.5120274914089347
RT_DIALOG	0x26decf0	0x4c2	data	Arabic	Saudi Arabia	0.4269293924466338
RT_DIALOG	0x26df1b4	0x27c	data	Chinese	Taiwan	0.5628930817610063
RT_DIALOG	0x26df430	0x53c	data	Czech	Czech Republic	0.4044776119402985
RT_DIALOG	0x26df96c	0x56c	data	Danish	Denmark	0.38328530259365995
RT_DIALOG	0x26dfed8	0x5d2	data	German	Germany	0.37718120805369126
RT_DIALOG	0x26e04ac	0x5f6	data	Greek	Greece	0.3951507208387942
RT_DIALOG	0x26e0aa4	0x4ea	data	English	United States	0.38235294117647056
RT_DIALOG	0x26e0f90	0x4b6	data	Finnish	Finland	0.3814262023217247
RT_DIALOG	0x26e1448	0x566	data	French	France	0.36396526772793053
RT_DIALOG	0x26e19b0	0x476	data	Hebrew	Israel	0.43695271453590195
RT_DIALOG	0x26e1e28	0x540	data	Hungarian	Hungary	0.4099702380952381
RT_DIALOG	0x26e2368	0x582	data	Italian	Italy	0.37375886524822693
RT_DIALOG	0x26e28ec	0x366	data	Japanese	Japan	0.5287356321839081
RT_DIALOG	0x26e2c54	0x32e	data	Korean	North Korea	0.5528255528255528
RT_DIALOG	0x26e2c54	0x32e	data	Korean	South Korea	0.5528255528255528
RT_DIALOG	0x26e2f84	0x558	data	Dutch	Netherlands	0.3713450292397661
RT_DIALOG	0x26e34dc	0x4fe	data	Norwegian	Norway	0.3755868544600939
RT_DIALOG	0x26e39dc	0x55c	data	Polish	Poland	0.39577259475218657
RT_DIALOG	0x26e3f38	0x560	data	Portuguese	Brazil	0.3633720930232558
RT_DIALOG	0x26e4498	0x538	data	Russian	Russia	0.40194610778443113
RT_DIALOG	0x26e49d0	0x538	data	Swedish	Sweden	0.38997005988023953
RT_DIALOG	0x26e4f08	0x526	data	Turkish	Turkey	0.3899848254931715
RT_DIALOG	0x26e5430	0x296	data	Chinese	China	0.5634441087613293
RT_DIALOG	0x26e56c8	0x54e	data	Portuguese	Portugal	0.3711340206185567
RT_DIALOG	0x26e5c18	0x54c	data			0.37168141592920356
RT_DIALOG	0x26e6164	0x3dc	data	Arabic	Saudi Arabia	0.4493927125506073
RT_DIALOG	0x26e6540	0x206	data	Chinese	Taiwan	0.6795366795366795
RT_DIALOG	0x26e6748	0x4ce	data	Czech	Czech Republic	0.4195121951219512
RT_DIALOG	0x26e6c18	0x4f6	data	Danish	Denmark	0.38661417322834646
RT_DIALOG	0x26e7110	0x590	data	German	Germany	0.3728932584269663
RT_DIALOG	0x26e76a0	0x4e0	data	Greek	Greece	0.4423076923076923
RT_DIALOG	0x26e7b80	0x438	data	English	United States	0.42314814814814816
RT_DIALOG	0x26e7fb8	0x48c	data	Finnish	Finland	0.3805841924398625
RT_DIALOG	0x26e8444	0x4e6	data	French	France	0.39553429027113235
RT_DIALOG	0x26e892c	0x3a6	data	Hebrew	Israel	0.4539614561027837
RT_DIALOG	0x26e8cd4	0x4fc	data	Hungarian	Hungary	0.42398119122257055
RT_DIALOG	0x26e91d0	0x506	data	Italian	Italy	0.37636080870917576
RT_DIALOG	0x26e96d8	0x2f2	data	Japanese	Japan	0.5848806366047745
RT_DIALOG	0x26e99cc	0x2c8	data	Korean	North Korea	0.601123595505618
RT_DIALOG	0x26e99cc	0x2c8	data	Korean	South Korea	0.601123595505618
RT_DIALOG	0x26e9c94	0x4b8	data	Dutch	Netherlands	0.396523178807947
RT_DIALOG	0x26ea14c	0x434	data	Norwegian	Norway	0.41821561338289964
RT_DIALOG	0x26ea580	0x560	data	Polish	Poland	0.3873546511627907
RT_DIALOG	0x26eaae0	0x4a4	data	Portuguese	Brazil	0.4166666666666667
RT_DIALOG	0x26eaf84	0x486	data	Russian	Russia	0.4119170984455959
RT_DIALOG	0x26eb40c	0x46c	data	Swedish	Sweden	0.3992932862190813
RT_DIALOG	0x26eb878	0x426	data	Turkish	Turkey	0.4152542372881356
RT_DIALOG	0x26ebca0	0x1fc	data	Chinese	China	0.6692913385826772
RT_DIALOG	0x26ebe9c	0x52c	data	Portuguese	Portugal	0.38972809667673713
RT_DIALOG	0x26ec3c8	0x4d2	data			0.38168557536466774
RT_DIALOG	0x26ec89c	0x198	data	Arabic	Saudi Arabia	0.5098039215686274
RT_DIALOG	0x26eca34	0x168	data	Chinese	Taiwan	0.49166666666666664
RT_DIALOG	0x26ecb9c	0x198	data	Czech	Czech Republic	0.49754901960784315
RT_DIALOG	0x26ecd34	0x1a8	data	Danish	Denmark	0.49292452830188677
RT_DIALOG	0x26ecedc	0x1d8	data	German	Germany	0.4788135593220339
RT_DIALOG	0x26ed0b4	0x1d4	data	Greek	Greece	0.5277777777777778
RT_DIALOG	0x26ed288	0x1a4	data	English	United States	0.47619047619047616
RT_DIALOG	0x26ed42c	0x1ac	data	Finnish	Finland	0.49065420560747663
RT_DIALOG	0x26ed5d8	0x1c4	data	French	France	0.4756637168141593
RT_DIALOG	0x26ed79c	0x190	data	Hebrew	Israel	0.525
RT_DIALOG	0x26ed92c	0x1b0	data	Hungarian	Hungary	0.5092592592592593
RT_DIALOG	0x26edadc	0x1ac	data	Italian	Italy	0.4976635514018692
RT_DIALOG	0x26edc88	0x184	data	Japanese	Japan	0.5257731958762887
RT_DIALOG	0x26ede0c	0x16c	data	Korean	North Korea	0.4835164835164835
RT_DIALOG	0x26ede0c	0x16c	data	Korean	South Korea	0.4835164835164835
RT_DIALOG	0x26edf78	0x1ac	data	Dutch	Netherlands	0.48598130841121495
RT_DIALOG	0x26ee124	0x19c	data	Norwegian	Norway	0.49029126213592233
RT_DIALOG	0x26ee2c0	0x1bc	data	Polish	Poland	0.5202702702702703
RT_DIALOG	0x26ee47c	0x1ac	data	Portuguese	Brazil	0.4929906542056075
RT_DIALOG	0x26ee628	0x1b4	data	Russian	Russia	0.4954128440366973
RT_DIALOG	0x26ee7dc	0x1a4	data	Swedish	Sweden	0.4857142857142857
RT_DIALOG	0x26ee980	0x1a0	data	Turkish	Turkey	0.49278846153846156
RT_DIALOG	0x26eeb20	0x164	data	Chinese	China	0.48314606741573035
RT_DIALOG	0x26eec84	0x1b0	data	Portuguese	Portugal	0.5092592592592593
RT_DIALOG	0x26eee34	0x1b4	data			0.46788990825688076
RT_DIALOG	0x26eefe8	0x346	data	Arabic	Saudi Arabia	0.4737470167064439
RT_DIALOG	0x26ef330	0x1a8	data	Chinese	Taiwan	0.7334905660377359
RT_DIALOG	0x26ef4d8	0x3aa	data	Czech	Czech Republic	0.43816631130063965
RT_DIALOG	0x26ef884	0x42e	data	Danish	Denmark	0.402803738317757
RT_DIALOG	0x26efcb4	0x48a	data	German	Germany	0.3795180722891566
RT_DIALOG	0x26f0140	0x4b6	data	Greek	Greece	0.42371475953565507
RT_DIALOG	0x26f05f8	0x394	data	English	United States	0.4203056768558952
RT_DIALOG	0x26f098c	0x3ec	data	Finnish	Finland	0.39641434262948205
RT_DIALOG	0x26f0d78	0x46a	data	French	France	0.38495575221238937
RT_DIALOG	0x26f11e4	0x2f6	data	Hebrew	Israel	0.46965699208443273
RT_DIALOG	0x26f14dc	0x422	data	Hungarian	Hungary	0.4168241965973535
RT_DIALOG	0x26f1900	0x418	data	Italian	Italy	0.3816793893129771
RT_DIALOG	0x26f1d18	0x24c	data	Japanese	Japan	0.6258503401360545
RT_DIALOG	0x26f1f64	0x21c	data	Korean	North Korea	0.6388888888888888
RT_DIALOG	0x26f1f64	0x21c	data	Korean	South Korea	0.6388888888888888
RT_DIALOG	0x26f2180	0x452	data	Dutch	Netherlands	0.3860759493670886
RT_DIALOG	0x26f25d4	0x3aa	data	Norwegian	Norway	0.4147121535181237
RT_DIALOG	0x26f2980	0x44e	data	Polish	Poland	0.4319419237749546
RT_DIALOG	0x26f2dd0	0x3d4	data	Portuguese	Brazil	0.42244897959183675
RT_DIALOG	0x26f31a4	0x3d8	data	Russian	Russia	0.42784552845528456
RT_DIALOG	0x26f357c	0x418	data	Swedish	Sweden	0.3816793893129771
RT_DIALOG	0x26f3994	0x3ec	data	Turkish	Turkey	0.4203187250996016
RT_DIALOG	0x26f3d80	0x194	data	Chinese	China	0.7227722772277227
RT_DIALOG	0x26f3f14	0x416	data	Portuguese	Portugal	0.4005736137667304
RT_DIALOG	0x26f432c	0x426	data			0.384180790960452
RT_DIALOG	0x26f4754	0x3a0	data	Arabic	Saudi Arabia	0.44288793103448276
RT_DIALOG	0x26f4af4	0x20c	data	Chinese	Taiwan	0.7175572519083969
RT_DIALOG	0x26f4d00	0x426	data	Czech	Czech Republic	0.4491525423728814
RT_DIALOG	0x26f5128	0x44a	data	Danish	Denmark	0.41530054644808745
RT_DIALOG	0x26f5574	0x448	data	German	Germany	0.41058394160583944
RT_DIALOG	0x26f59bc	0x536	data	Greek	Greece	0.4295352323838081
RT_DIALOG	0x26f5ef4	0x3fc	data	English	United States	0.43137254901960786
RT_DIALOG	0x26f62f0	0x50c	data	Finnish	Finland	0.37306501547987614
RT_DIALOG	0x26f67fc	0x4ca	data	French	France	0.398858075040783
RT_DIALOG	0x26f6cc8	0x374	data	Hebrew	Israel	0.4819004524886878
RT_DIALOG	0x26f703c	0x476	data	Hungarian	Hungary	0.45271453590192645
RT_DIALOG	0x26f74b4	0x448	data	Italian	Italy	0.41514598540145986
RT_DIALOG	0x26f78fc	0x2a4	data	Japanese	Japan	0.6301775147928994
RT_DIALOG	0x26f7ba0	0x262	data	Korean	North Korea	0.6524590163934426
RT_DIALOG	0x26f7ba0	0x262	data	Korean	South Korea	0.6524590163934426
RT_DIALOG	0x26f7e04	0x4c4	data	Dutch	Netherlands	0.38278688524590165
RT_DIALOG	0x26f82c8	0x3a2	data	Norwegian	Norway	0.432258064516129
RT_DIALOG	0x26f866c	0x478	data	Polish	Poland	0.4458041958041958
RT_DIALOG	0x26f8ae4	0x43e	data	Portuguese	Brazil	0.429097605893186
RT_DIALOG	0x26f8f24	0x460	data	Russian	Russia	0.4419642857142857
RT_DIALOG	0x26f9384	0x41c	data	Swedish	Sweden	0.42490494296577946
RT_DIALOG	0x26f97a0	0x442	data	Turkish	Turkey	0.43944954128440367
RT_DIALOG	0x26f9be4	0x1f2	data	Chinese	China	0.714859437751004
RT_DIALOG	0x26f9dd8	0x48e	data	Portuguese	Portugal	0.41080617495711835
RT_DIALOG	0x26fa268	0x47e	data			0.4017391304347826
RT_DIALOG	0x26fa6e8	0x210	data	Arabic	Saudi Arabia	0.5340909090909091
RT_DIALOG	0x26fa8f8	0x120	data	Chinese	Taiwan	0.7361111111111112
RT_DIALOG	0x26faa18	0x224	data	Czech	Czech Republic	0.541970802919708
RT_DIALOG	0x26fac3c	0x264	data	Danish	Denmark	0.5016339869281046
RT_DIALOG	0x26faea0	0x288	data	German	Germany	0.48919753086419754
RT_DIALOG	0x26fb128	0x294	data	Greek	Greece	0.5257575757575758
RT_DIALOG	0x26fb3bc	0x26c	data	English	United States	0.47096774193548385
RT_DIALOG	0x26fb628	0x23c	data	Finnish	Finland	0.4737762237762238
RT_DIALOG	0x26fb864	0x2a8	data	French	France	0.47205882352941175
RT_DIALOG	0x26fbb0c	0x1b4	data	Hebrew	Israel	0.6032110091743119
RT_DIALOG	0x26fbcc0	0x254	data	Hungarian	Hungary	0.48825503355704697
RT_DIALOG	0x26fbf14	0x220	data	Italian	Italy	0.5183823529411765
RT_DIALOG	0x26fc134	0x168	data	Japanese	Japan	0.7166666666666667
RT_DIALOG	0x26fc29c	0x158	data	Korean	North Korea	0.6918604651162791
RT_DIALOG	0x26fc29c	0x158	data	Korean	South Korea	0.6918604651162791
RT_DIALOG	0x26fc3f4	0x2a8	data	Dutch	Netherlands	0.47941176470588237
RT_DIALOG	0x26fc69c	0x23c	data	Norwegian	Norway	0.4982517482517482
RT_DIALOG	0x26fc8d8	0x254	data	Polish	Poland	0.5033557046979866
RT_DIALOG	0x26fcb2c	0x294	data	Portuguese	Brazil	0.45606060606060606
RT_DIALOG	0x26fcdc0	0x214	data	Russian	Russia	0.5469924812030075
RT_DIALOG	0x26fcfd4	0x268	data	Swedish	Sweden	0.4967532467532468
RT_DIALOG	0x26fd23c	0x26c	data	Turkish	Turkey	0.49193548387096775
RT_DIALOG	0x26fd4a8	0x114	data	Chinese	China	0.7246376811594203
RT_DIALOG	0x26fd5bc	0x270	data	Portuguese	Portugal	0.48717948717948717
RT_DIALOG	0x26fd82c	0x2a0	data			0.45535714285714285
RT_DIALOG	0x26fdacc	0x464	data	Arabic	Saudi Arabia	0.4706405693950178
RT_DIALOG	0x26fdf30	0x300	data	Chinese	Taiwan	0.5755208333333334
RT_DIALOG	0x26fe230	0x4d8	data	Czech	Czech Republic	0.4258064516129032
RT_DIALOG	0x26fe708	0x53c	data	Danish	Denmark	0.41492537313432837
RT_DIALOG	0x26fec44	0x5c0	data	German	Germany	0.40625
RT_DIALOG	0x26ff204	0x590	data	Greek	Greece	0.4515449438202247
RT_DIALOG	0x26ff794	0x470	data	English	United States	0.43661971830985913
RT_DIALOG	0x26ffc04	0x4d8	data	Finnish	Finland	0.43629032258064515
RT_DIALOG	0x27000dc	0x56c	data	French	France	0.41714697406340057
RT_DIALOG	0x2700648	0x434	data	Hebrew	Israel	0.4804832713754647
RT_DIALOG	0x2700a7c	0x514	data	Hungarian	Hungary	0.44769230769230767
RT_DIALOG	0x2700f90	0x5c0	data	Italian	Italy	0.3960597826086957
RT_DIALOG	0x2701550	0x384	data	Japanese	Japan	0.5588888888888889
RT_DIALOG	0x27018d4	0x36c	data	Korean	North Korea	0.5730593607305936
RT_DIALOG	0x27018d4	0x36c	data	Korean	South Korea	0.5730593607305936
RT_DIALOG	0x2701c40	0x5e4	data	Dutch	Netherlands	0.393236074270557
RT_DIALOG	0x2702224	0x4e4	data	Norwegian	Norway	0.4249201277955272
RT_DIALOG	0x2702708	0x540	data	Polish	Poland	0.4263392857142857
RT_DIALOG	0x2702c48	0x4dc	data	Portuguese	Brazil	0.42443729903536975
RT_DIALOG	0x2703124	0x518	data	Russian	Russia	0.4516871165644172
RT_DIALOG	0x270363c	0x500	data	Swedish	Sweden	0.4328125
RT_DIALOG	0x2703b3c	0x540	data	Turkish	Turkey	0.42336309523809523
RT_DIALOG	0x270407c	0x2fc	data	Chinese	China	0.6007853403141361
RT_DIALOG	0x2704378	0x4f8	data	Portuguese	Portugal	0.4143081761006289
RT_DIALOG	0x2704870	0x51c	data			0.40214067278287463
RT_DIALOG	0x2704d8c	0x40c	data	Arabic	Saudi Arabia	0.4420849420849421
RT_DIALOG	0x2705198	0x270	data	Chinese	Taiwan	0.6378205128205128
RT_DIALOG	0x2705408	0x48a	data	Czech	Czech Republic	0.4259896729776248
RT_DIALOG	0x2705894	0x4a8	data	Danish	Denmark	0.40268456375838924
RT_DIALOG	0x2705d3c	0x51c	data	German	Germany	0.386085626911315
RT_DIALOG	0x2706258	0x52c	data	Greek	Greece	0.43202416918429004
RT_DIALOG	0x2706784	0x48c	data	English	United States	0.4106529209621993
RT_DIALOG	0x2706c10	0x470	data	Finnish	Finland	0.3970070422535211
RT_DIALOG	0x2707080	0x510	data	French	France	0.3896604938271605
RT_DIALOG	0x2707590	0x3a6	data	Hebrew	Israel	0.4743040685224839
RT_DIALOG	0x2707938	0x4c0	data	Hungarian	Hungary	0.42105263157894735
RT_DIALOG	0x2707df8	0x49a	data	Italian	Italy	0.40237691001697795
RT_DIALOG	0x2708294	0x320	data	Japanese	Japan	0.58
RT_DIALOG	0x27085b4	0x30e	data	Korean	North Korea	0.5959079283887468
RT_DIALOG	0x27085b4	0x30e	data	Korean	South Korea	0.5959079283887468
RT_DIALOG	0x27088c4	0x50a	data	Dutch	Netherlands	0.3883720930232558
RT_DIALOG	0x2708dd0	0x484	data	Norwegian	Norway	0.39792387543252594
RT_DIALOG	0x2709254	0x52c	data	Polish	Poland	0.4078549848942598
RT_DIALOG	0x2709780	0x49e	data	Portuguese	Brazil	0.4365482233502538
RT_DIALOG	0x2709c20	0x4c2	data	Russian	Russia	0.4376026272577997
RT_DIALOG	0x270a0e4	0x4bc	data	Swedish	Sweden	0.39026402640264024
RT_DIALOG	0x270a5a0	0x4ba	data	Turkish	Turkey	0.4033057851239669
RT_DIALOG	0x270aa5c	0x264	data	Chinese	China	0.6372549019607843
RT_DIALOG	0x270acc0	0x4c0	data	Portuguese	Portugal	0.39555921052631576
RT_DIALOG	0x270b180	0x4a8	data			0.39429530201342283
RT_DIALOG	0x270b628	0x1d6	data	Arabic	Saudi Arabia	0.6191489361702127
RT_DIALOG	0x270b800	0x12c	data	Chinese	Taiwan	0.7966666666666666
RT_DIALOG	0x270b92c	0x210	data	Czech	Czech Republic	0.5757575757575758
RT_DIALOG	0x270bb3c	0x258	data	Danish	Denmark	0.505
RT_DIALOG	0x270bd94	0x240	data	German	Germany	0.5347222222222222
RT_DIALOG	0x270bfd4	0x244	data	Greek	Greece	0.5982758620689655
RT_DIALOG	0x270c218	0x1dc	data	English	United States	0.5546218487394958
RT_DIALOG	0x270c3f4	0x200	data	Finnish	Finland	0.541015625
RT_DIALOG	0x270c5f4	0x21c	data	French	France	0.5407407407407407
RT_DIALOG	0x270c810	0x1b2	data	Hebrew	Israel	0.6336405529953917
RT_DIALOG	0x270c9c4	0x208	data	Hungarian	Hungary	0.5711538461538461
RT_DIALOG	0x270cbcc	0x214	data	Italian	Italy	0.5451127819548872
RT_DIALOG	0x270cde0	0x174	data	Japanese	Japan	0.7231182795698925
RT_DIALOG	0x270cf54	0x150	data	Korean	North Korea	0.7857142857142857
RT_DIALOG	0x270cf54	0x150	data	Korean	South Korea	0.7857142857142857
RT_DIALOG	0x270d0a4	0x234	data	Dutch	Netherlands	0.5124113475177305
RT_DIALOG	0x270d2d8	0x1e4	data	Norwegian	Norway	0.5475206611570248
RT_DIALOG	0x270d4bc	0x214	data	Polish	Poland	0.5845864661654135
RT_DIALOG	0x270d6d0	0x244	data	Portuguese	Brazil	0.5206896551724138
RT_DIALOG	0x270d914	0x21c	data	Russian	Russia	0.5814814814814815
RT_DIALOG	0x270db30	0x228	data	Swedish	Sweden	0.532608695652174
RT_DIALOG	0x270dd58	0x21e	data	Turkish	Turkey	0.5424354243542435
RT_DIALOG	0x270df78	0x11c	data	Chinese	China	0.778169014084507
RT_DIALOG	0x270e094	0x20c	data	Portuguese	Portugal	0.5458015267175572
RT_DIALOG	0x270e2a0	0x24a	data			0.5187713310580204
RT_DIALOG	0x270e4ec	0x376	data	Arabic	Saudi Arabia	0.5316027088036117
RT_DIALOG	0x270e864	0x248	data	Chinese	Taiwan	0.696917808219178
RT_DIALOG	0x270eaac	0x388	data	Czech	Czech Republic	0.5353982300884956
RT_DIALOG	0x270ee34	0x390	data	Danish	Denmark	0.48793859649122806
RT_DIALOG	0x270f1c4	0x3d6	data	German	Germany	0.47046843177189407
RT_DIALOG	0x270f59c	0x3f6	data	Greek	Greece	0.5374753451676528
RT_DIALOG	0x270f994	0x398	data	English	United States	0.4891304347826087
RT_DIALOG	0x270fd2c	0x372	data	Finnish	Finland	0.4965986394557823
RT_DIALOG	0x27100a0	0x3ee	data	French	France	0.4870775347912525
RT_DIALOG	0x2710490	0x326	data	Hebrew	Israel	0.5483870967741935
RT_DIALOG	0x27107b8	0x3fa	data	Hungarian	Hungary	0.5049115913555993
RT_DIALOG	0x2710bb4	0x39e	data	Italian	Italy	0.49136069114470843
RT_DIALOG	0x2710f54	0x2be	data	Japanese	Japan	0.6410256410256411
RT_DIALOG	0x2711214	0x298	data	Korean	North Korea	0.6807228915662651
RT_DIALOG	0x2711214	0x298	data	Korean	South Korea	0.6807228915662651
RT_DIALOG	0x27114ac	0x412	data	Dutch	Netherlands	0.46641074856046066
RT_DIALOG	0x27118c0	0x3c4	data	Norwegian	Norway	0.47199170124481327
RT_DIALOG	0x2711c84	0x3d8	data	Polish	Poland	0.5091463414634146
RT_DIALOG	0x271205c	0x3f0	data	Portuguese	Brazil	0.49007936507936506
RT_DIALOG	0x271244c	0x390	data	Russian	Russia	0.5471491228070176
RT_DIALOG	0x27127dc	0x390	data	Swedish	Sweden	0.4956140350877193
RT_DIALOG	0x2712b6c	0x3f2	data	Turkish	Turkey	0.5
RT_DIALOG	0x2712f60	0x238	data	Chinese	China	0.6813380281690141
RT_DIALOG	0x2713198	0x3f4	data	Portuguese	Portugal	0.4782608695652174
RT_DIALOG	0x271358c	0x400	data			0.46875
RT_DIALOG	0x271398c	0x1f2	data	Arabic	Saudi Arabia	0.6004016064257028
RT_DIALOG	0x2713b80	0x144	data	Chinese	Taiwan	0.7376543209876543
RT_DIALOG	0x2713cc4	0x204	data	Czech	Czech Republic	0.5891472868217055
RT_DIALOG	0x2713ec8	0x224	data	Danish	Denmark	0.551094890510949
RT_DIALOG	0x27140ec	0x206	data	German	Germany	0.5347490347490348
RT_DIALOG	0x27142f4	0x246	data	Greek	Greece	0.5859106529209622
RT_DIALOG	0x271453c	0x218	data	English	United States	0.5466417910447762
RT_DIALOG	0x2714754	0x236	data	Finnish	Finland	0.5265017667844523
RT_DIALOG	0x271498c	0x246	data	French	France	0.5395189003436426
RT_DIALOG	0x2714bd4	0x1ce	data	Hebrew	Israel	0.6233766233766234
RT_DIALOG	0x2714da4	0x24a	data	Hungarian	Hungary	0.5580204778156996
RT_DIALOG	0x2714ff0	0x222	data	Italian	Italy	0.5366300366300366
RT_DIALOG	0x2715214	0x1ae	data	Japanese	Japan	0.6953488372093023
RT_DIALOG	0x27153c4	0x170	data	Korean	North Korea	0.7336956521739131
RT_DIALOG	0x27153c4	0x170	data	Korean	South Korea	0.7336956521739131
RT_DIALOG	0x2715534	0x256	data	Dutch	Netherlands	0.520066889632107
RT_DIALOG	0x271578c	0x1f4	data	Norwegian	Norway	0.564
RT_DIALOG	0x2715980	0x218	data	Polish	Poland	0.5671641791044776
RT_DIALOG	0x2715b98	0x24c	data	Portuguese	Brazil	0.5357142857142857
RT_DIALOG	0x2715de4	0x1fc	data	Russian	Russia	0.5885826771653543
RT_DIALOG	0x2715fe0	0x1f8	data	Swedish	Sweden	0.5674603174603174
RT_DIALOG	0x27161d8	0x222	data	Turkish	Turkey	0.5677655677655677
RT_DIALOG	0x27163fc	0x148	data	Chinese	China	0.7469512195121951
RT_DIALOG	0x2716544	0x264	data	Portuguese	Portugal	0.5196078431372549
RT_DIALOG	0x27167a8	0x27c	data			0.5141509433962265
RT_DIALOG	0x2716a24	0x2f6	data	Arabic	Saudi Arabia	0.43535620052770446
RT_DIALOG	0x2716d1c	0x15a	data	Chinese	Taiwan	0.6907514450867052
RT_DIALOG	0x2716e78	0x398	data	Czech	Czech Republic	0.425
RT_DIALOG	0x2717210	0x31c	data	Danish	Denmark	0.40954773869346733
RT_DIALOG	0x271752c	0x35e	data	German	Germany	0.39211136890951276
RT_DIALOG	0x271788c	0x35a	data	Greek	Greece	0.4417249417249417
RT_DIALOG	0x2717be8	0x2d4	data	English	United States	0.4005524861878453
RT_DIALOG	0x2717ebc	0x32c	data	Finnish	Finland	0.3977832512315271
RT_DIALOG	0x27181e8	0x392	data	French	France	0.37199124726477023
RT_DIALOG	0x271857c	0x274	data	Hebrew	Israel	0.46496815286624205
RT_DIALOG	0x27187f0	0x3f8	data	Hungarian	Hungary	0.3937007874015748
RT_DIALOG	0x2718be8	0x376	data	Italian	Italy	0.38487584650112866
RT_DIALOG	0x2718f60	0x228	data	Japanese	Japan	0.5742753623188406
RT_DIALOG	0x2719188	0x1ea	data	Korean	North Korea	0.6081632653061224
RT_DIALOG	0x2719188	0x1ea	data	Korean	South Korea	0.6081632653061224
RT_DIALOG	0x2719374	0x39c	data	Dutch	Netherlands	0.36796536796536794
RT_DIALOG	0x2719710	0x2d4	data	Norwegian	Norway	0.4074585635359116
RT_DIALOG	0x27199e4	0x35e	data	Polish	Poland	0.38979118329466356
RT_DIALOG	0x2719d44	0x34e	data	Portuguese	Brazil	0.39361702127659576
RT_DIALOG	0x271a094	0x340	data	Russian	Russia	0.4014423076923077
RT_DIALOG	0x271a3d4	0x284	data	Swedish	Sweden	0.4363354037267081
RT_DIALOG	0x271a658	0x338	data	Turkish	Turkey	0.41262135922330095
RT_DIALOG	0x271a990	0x158	data	Chinese	China	0.7151162790697675
RT_DIALOG	0x271aae8	0x336	data	Portuguese	Portugal	0.4002433090024331
RT_DIALOG	0x271ae20	0x360	data			0.3773148148148148
RT_DIALOG	0x271b180	0xb8	data	Arabic	Saudi Arabia	0.717391304347826
RT_DIALOG	0x271b238	0xa0	data	Chinese	Taiwan	0.71875
RT_DIALOG	0x271b2d8	0xb0	data	Czech	Czech Republic	0.6875
RT_DIALOG	0x271b388	0xb0	data	Danish	Denmark	0.6875
RT_DIALOG	0x271b438	0xb0	data	German	Germany	0.6875
RT_DIALOG	0x271b4e8	0xb0	data	Greek	Greece	0.6875
RT_DIALOG	0x271b598	0xb0	data	English	United States	0.6931818181818182
RT_DIALOG	0x271b648	0xb0	data	Finnish	Finland	0.6875
RT_DIALOG	0x271b6f8	0xb0	data	French	France	0.6875
RT_DIALOG	0x271b7a8	0xb8	data	Hebrew	Israel	0.717391304347826
RT_DIALOG	0x271b860	0xb0	data	Hungarian	Hungary	0.6875
RT_DIALOG	0x271b910	0xb0	data	Italian	Italy	0.6875
RT_DIALOG	0x271b9c0	0xac	data	Japanese	Japan	0.6976744186046512
RT_DIALOG	0x271ba6c	0x9c	data	Korean	North Korea	0.7115384615384616
RT_DIALOG	0x271ba6c	0x9c	data	Korean	South Korea	0.7115384615384616
RT_DIALOG	0x271bb08	0xb0	data	Dutch	Netherlands	0.6875
RT_DIALOG	0x271bbb8	0xb0	data	Norwegian	Norway	0.6875
RT_DIALOG	0x271bc68	0xb0	data	Polish	Poland	0.6875
RT_DIALOG	0x271bd18	0xb0	data	Portuguese	Brazil	0.6875
RT_DIALOG	0x271bdc8	0xb0	data	Russian	Russia	0.6988636363636364
RT_DIALOG	0x271be78	0xb0	data	Swedish	Sweden	0.6875
RT_DIALOG	0x271bf28	0xb8	data	Turkish	Turkey	0.6739130434782609
RT_DIALOG	0x271bfe0	0x9c	data	Chinese	China	0.7051282051282052
RT_DIALOG	0x271c07c	0xb0	data	Portuguese	Portugal	0.6875
RT_DIALOG	0x271c12c	0xbc	data			0.6968085106382979
RT_STRING	0x271c1e8	0x51c	data	Arabic	Saudi Arabia	0.4319571865443425
RT_STRING	0x271c704	0x294	data	Chinese	Taiwan	0.7151515151515152
RT_STRING	0x271c998	0x61a	data	Czech	Czech Republic	0.40717029449423814
RT_STRING	0x271cfb4	0x60a	data	Danish	Denmark	0.3745148771021992
RT_STRING	0x271d5c0	0x5d6	data	German	Germany	0.3969210174029451
RT_STRING	0x271db98	0x638	data	Greek	Greece	0.4214824120603015
RT_STRING	0x271e1d0	0x506	data	English	United States	0.40279937791601866
RT_STRING	0x271e6d8	0x54e	data	Finnish	Finland	0.3807069219440353
RT_STRING	0x271ec28	0x5f8	data	French	France	0.35602094240837695
RT_STRING	0x271f220	0x49e	data	Hebrew	Israel	0.461082910321489
RT_STRING	0x271f6c0	0x522	data	Hungarian	Hungary	0.4345509893455099
RT_STRING	0x271fbe4	0x57e	data	Italian	Italy	0.3940256045519203
RT_STRING	0x2720164	0x3ba	data	Japanese	Japan	0.5974842767295597
RT_STRING	0x2720520	0x338	data	Korean	North Korea	0.6395631067961165
RT_STRING	0x2720520	0x338	data	Korean	South Korea	0.6395631067961165
RT_STRING	0x2720858	0x67c	data	Dutch	Netherlands	0.33674698795180724
RT_STRING	0x2720ed4	0x53c	data	Norwegian	Norway	0.3738805970149254
RT_STRING	0x2721410	0x5e6	data	Polish	Poland	0.40463576158940395
RT_STRING	0x27219f8	0x618	data	Portuguese	Brazil	0.37243589743589745
RT_STRING	0x2722010	0x5e4	data	Russian	Russia	0.3879310344827586
RT_STRING	0x27225f4	0x5c2	data	Swedish	Sweden	0.3805970149253731
RT_STRING	0x2722bb8	0x5a8	data	Turkish	Turkey	0.40124309392265195
RT_STRING	0x2723160	0x282	data	Chinese	China	0.7133956386292835
RT_STRING	0x27233e4	0x5d0	data	Portuguese	Portugal	0.364247311827957
RT_STRING	0x27239b4	0x604	data			0.3538961038961039
RT_STRING	0x2723fb8	0x368e	data	Arabic	Saudi Arabia	0.25590720320779037
RT_STRING	0x2727648	0x16bc	data	Chinese	Taiwan	0.5036082474226804
RT_STRING	0x2728d04	0x3e94	data	Czech	Czech Republic	0.26897627965043697
RT_STRING	0x272cb98	0x4004	data	Danish	Denmark	0.23822309006590187
RT_STRING	0x2730b9c	0x4950	data	German	Germany	0.2348678601875533
RT_STRING	0x27354ec	0x4c22	0421 Alliant compact executable not stripped	Greek	Greece	0.24371472550025655
RT_STRING	0x273a110	0x3a08	data	English	United States	0.23673936456650513
RT_STRING	0x273db18	0x3d72	data	Finnish	Finland	0.24342021614748888
RT_STRING	0x274188c	0x4822	PDP-11 old overlay	French	France	0.2312899382649193
RT_STRING	0x27460b0	0x2eee	data	Hebrew	Israel	0.2714333277842517
RT_STRING	0x2748fa0	0x446e	PDP-11 old overlay	Hungarian	Hungary	0.251398561479621
RT_STRING	0x274d410	0x4ee8	data	Italian	Italy	0.21455445544554455
RT_STRING	0x27522f8	0x22fe	data	Japanese	Japan	0.36626479124804645
RT_STRING	0x27545f8	0x21e8	data	Korean	North Korea	0.3601382488479263
RT_STRING	0x27545f8	0x21e8	data	Korean	South Korea	0.3601382488479263
RT_STRING	0x27567e0	0x477e	data	Dutch	Netherlands	0.22341820566058354
RT_STRING	0x275af60	0x3edc	data	Norwegian	Norway	0.2298036291324882
RT_STRING	0x275ee3c	0x48e6	data	Polish	Poland	0.23550530489765298
RT_STRING	0x2763724	0x40b6	data	Portuguese	Brazil	0.23856090788361706
RT_STRING	0x27677dc	0x4a96	data	Russian	Russia	0.23923745679270975
RT_STRING	0x276c274	0x3ef0	data	Swedish	Sweden	0.23659384309831183
RT_STRING	0x2770164	0x3ee0	data	Turkish	Turkey	0.24204771371769385
RT_STRING	0x2774044	0x16c6	data	Chinese	China	0.49845626072041166
RT_STRING	0x277570c	0x4568	PDP-11 executable not stripped	Portuguese	Portugal	0.23007654209815398
RT_STRING	0x2779c74	0x485a	PDP-11 separate I&D executable not stripped			0.22826908541194255
RT_STRING	0x277e4d0	0x5a	data	Arabic	Saudi Arabia	0.6777777777777778
RT_STRING	0x277e52c	0x44	data	Chinese	Taiwan	0.5
RT_STRING	0x277e570	0x5c	data	Czech	Czech Republic	0.7391304347826086
RT_STRING	0x277e5cc	0x5c	data	Danish	Denmark	0.6847826086956522
RT_STRING	0x277e628	0x44	data	German	Germany	0.6911764705882353
RT_STRING	0x277e66c	0x52	data	Greek	Greece	0.6829268292682927
RT_STRING	0x277e6c0	0x50	data	English	United States	0.725
RT_STRING	0x277e710	0x80	data	Finnish	Finland	0.5859375
RT_STRING	0x277e790	0x5c	data	French	France	0.6956521739130435
RT_STRING	0x277e7ec	0x54	data	Hebrew	Israel	0.75
RT_STRING	0x277e840	0x6c	data	Hungarian	Hungary	0.6574074074074074
RT_STRING	0x277e8ac	0x48	data	Italian	Italy	0.7222222222222222
RT_STRING	0x277e8f4	0x44	data	Japanese	Japan	0.5
RT_STRING	0x277e938	0x38	data	Korean	North Korea	0.5892857142857143
RT_STRING	0x277e938	0x38	data	Korean	South Korea	0.5892857142857143
RT_STRING	0x277e970	0x44	data	Dutch	Netherlands	0.7058823529411765
RT_STRING	0x277e9b4	0x5a	data	Norwegian	Norway	0.6888888888888889
RT_STRING	0x277ea10	0x38	data	Polish	Poland	0.5357142857142857
RT_STRING	0x277ea48	0x2c	data	Portuguese	Brazil	0.6363636363636364
RT_STRING	0x277ea74	0x5c	data	Russian	Russia	0.7282608695652174
RT_STRING	0x277ead0	0x4e	data	Swedish	Sweden	0.6923076923076923
RT_STRING	0x277eb20	0x50	data	Turkish	Turkey	0.65
RT_STRING	0x277eb70	0x38	data	Chinese	China	0.5714285714285714
RT_STRING	0x277eba8	0x56	data	Portuguese	Portugal	0.7325581395348837
RT_STRING	0x277ec00	0x4a	data			0.7162162162162162
RT_STRING	0x277ec4c	0x450	data	Arabic	Saudi Arabia	0.41938405797101447
RT_STRING	0x277f09c	0x1b8	data	Chinese	Taiwan	0.7886363636363637
RT_STRING	0x277f254	0x3f8	data	Czech	Czech Republic	0.45866141732283466
RT_STRING	0x277f64c	0x410	data	Danish	Denmark	0.4269230769230769
RT_STRING	0x277fa5c	0x460	data	German	Germany	0.43214285714285716
RT_STRING	0x277febc	0x4b6	data	Greek	Greece	0.43449419568822556
RT_STRING	0x2780374	0x3d8	data	English	United States	0.42073170731707316
RT_STRING	0x278074c	0x45a	data	Finnish	Finland	0.4120287253141831
RT_STRING	0x2780ba8	0x4fc	data	French	France	0.3981191222570533
RT_STRING	0x27810a4	0x358	data	Hebrew	Israel	0.48130841121495327
RT_STRING	0x27813fc	0x484	data	Hungarian	Hungary	0.435121107266436
RT_STRING	0x2781880	0x3d2	data	Italian	Italy	0.43558282208588955
RT_STRING	0x2781c54	0x240	data	Japanese	Japan	0.6475694444444444
RT_STRING	0x2781e94	0x23e	data	Korean	North Korea	0.7195121951219512
RT_STRING	0x2781e94	0x23e	data	Korean	South Korea	0.7195121951219512
RT_STRING	0x27820d4	0x4ba	data	Dutch	Netherlands	0.37107438016528926
RT_STRING	0x2782590	0x40e	data	Norwegian	Norway	0.42485549132947975
RT_STRING	0x27829a0	0x452	data	Polish	Poland	0.4168173598553345
RT_STRING	0x2782df4	0x40a	data	Portuguese	Brazil	0.425531914893617
RT_STRING	0x2783200	0x470	data	Russian	Russia	0.44014084507042256
RT_STRING	0x2783670	0x3ac	data	Swedish	Sweden	0.4297872340425532
RT_STRING	0x2783a1c	0x476	data	Turkish	Turkey	0.4264448336252189
RT_STRING	0x2783e94	0x19c	data	Chinese	China	0.7936893203883495
RT_STRING	0x2784030	0x41e	data	Portuguese	Portugal	0.41840607210626185
RT_STRING	0x2784450	0x45c	data			0.3951612903225806
RT_STRING	0x27848ac	0x364	data	Arabic	Saudi Arabia	0.3675115207373272
RT_STRING	0x2784c10	0x150	data	Chinese	Taiwan	0.6607142857142857
RT_STRING	0x2784d60	0x38e	data	Czech	Czech Republic	0.35824175824175825
RT_STRING	0x27850f0	0x386	data	Danish	Denmark	0.33813747228381374
RT_STRING	0x2785478	0x3b8	data	German	Germany	0.32668067226890757
RT_STRING	0x2785830	0x3fe	data	Greek	Greece	0.3649706457925636
RT_STRING	0x2785c30	0x348	data	English	United States	0.3261904761904762
RT_STRING	0x2785f78	0x384	data	Finnish	Finland	0.31666666666666665
RT_STRING	0x27862fc	0x404	data	French	France	0.31712062256809337
RT_STRING	0x2786700	0x288	AmigaOS bitmap font "\325\005\324\005\352\005\324\005,", fc_YSize 4294955013, 54789 elements	Hebrew	Israel	0.42746913580246915
RT_STRING	0x2786988	0x3c0	data	Hungarian	Hungary	0.3572916666666667
RT_STRING	0x2786d48	0x36a	data	Italian	Italy	0.34553775743707094
RT_STRING	0x27870b4	0x206	data	Japanese	Japan	0.5347490347490348
RT_STRING	0x27872bc	0x192	data	Korean	North Korea	0.6766169154228856
RT_STRING	0x27872bc	0x192	data	Korean	South Korea	0.6766169154228856
RT_STRING	0x2787450	0x3d8	data	Dutch	Netherlands	0.29776422764227645
RT_STRING	0x2787828	0x348	data	Norwegian	Norway	0.3380952380952381
RT_STRING	0x2787b70	0x3f2	data	Polish	Poland	0.33564356435643566
RT_STRING	0x2787f64	0x3b8	data	Portuguese	Brazil	0.3224789915966387
RT_STRING	0x278831c	0x3be	data	Russian	Russia	0.33820459290187893
RT_STRING	0x27886dc	0x326	data	Swedish	Sweden	0.3610421836228288
RT_STRING	0x2788a04	0x3ae	data	Turkish	Turkey	0.3333333333333333
RT_STRING	0x2788db4	0x146	data	Chinese	China	0.696319018404908
RT_STRING	0x2788efc	0x38c	data	Portuguese	Portugal	0.33480176211453744
RT_STRING	0x2789288	0x3f0	data			0.3115079365079365
RT_STRING	0x2789678	0xd0	data	Arabic	Saudi Arabia	0.4855769230769231
RT_STRING	0x2789748	0x56	data	Chinese	Taiwan	0.6976744186046512
RT_STRING	0x27897a0	0xde	data	Czech	Czech Republic	0.6036036036036037
RT_STRING	0x2789880	0xe0	data	Danish	Denmark	0.5357142857142857
RT_STRING	0x2789960	0xfe	data	German	Germany	0.5118110236220472
RT_STRING	0x2789a60	0x112	data	Greek	Greece	0.5036496350364964
RT_STRING	0x2789b74	0xe6	data	English	United States	0.46956521739130436
RT_STRING	0x2789c5c	0xcc	data	Finnish	Finland	0.5392156862745098
RT_STRING	0x2789d28	0x120	data	French	France	0.4097222222222222
RT_STRING	0x2789e48	0xbe	data	Hebrew	Israel	0.5842105263157895
RT_STRING	0x2789f08	0xf4	data	Hungarian	Hungary	0.5081967213114754
RT_STRING	0x2789ffc	0x13a	data	Italian	Italy	0.4394904458598726
RT_STRING	0x278a138	0x8c	data	Japanese	Japan	0.6928571428571428
RT_STRING	0x278a1c4	0x82	data	Korean	North Korea	0.6384615384615384
RT_STRING	0x278a1c4	0x82	data	Korean	South Korea	0.6384615384615384
RT_STRING	0x278a248	0xfe	data	Dutch	Netherlands	0.484251968503937
RT_STRING	0x278a348	0xe8	data	Norwegian	Norway	0.49137931034482757
RT_STRING	0x278a430	0x134	data	Polish	Poland	0.4837662337662338
RT_STRING	0x278a564	0x116	data	Portuguese	Brazil	0.49280575539568344
RT_STRING	0x278a67c	0xf2	data	Russian	Russia	0.5661157024793388
RT_STRING	0x278a770	0xb4	data	Swedish	Sweden	0.5888888888888889
RT_STRING	0x278a824	0x102	data	Turkish	Turkey	0.49224806201550386
RT_STRING	0x278a928	0x5a	data	Chinese	China	0.7
RT_STRING	0x278a984	0x128	data	Portuguese	Portugal	0.4358108108108108
RT_STRING	0x278aaac	0x128	data			0.40878378378378377
RT_STRING	0x278abd4	0x124	data	Arabic	Saudi Arabia	0.565068493150685
RT_STRING	0x278acf8	0x82	data	Chinese	Taiwan	0.7769230769230769
RT_STRING	0x278ad7c	0x10e	data	Czech	Czech Republic	0.5703703703703704
RT_STRING	0x278ae8c	0x108	data	Danish	Denmark	0.49242424242424243
RT_STRING	0x278af94	0xe6	data	German	Germany	0.5652173913043478
RT_STRING	0x278b07c	0x168	data	Greek	Greece	0.525
RT_STRING	0x278b1e4	0x134	data	English	United States	0.4902597402597403
RT_STRING	0x278b318	0x142	data	Finnish	Finland	0.515527950310559
RT_STRING	0x278b45c	0x178	data	French	France	0.449468085106383
RT_STRING	0x278b5d4	0x114	data	Hebrew	Israel	0.5833333333333334
RT_STRING	0x278b6e8	0x11a	data	Hungarian	Hungary	0.5531914893617021
RT_STRING	0x278b804	0x10c	data	Italian	Italy	0.5111940298507462
RT_STRING	0x278b910	0xc6	data	Japanese	Japan	0.7373737373737373
RT_STRING	0x278b9d8	0xaa	data	Korean	North Korea	0.7529411764705882
RT_STRING	0x278b9d8	0xaa	data	Korean	South Korea	0.7529411764705882
RT_STRING	0x278ba84	0x172	data	Dutch	Netherlands	0.44324324324324327
RT_STRING	0x278bbf8	0x150	data	Norwegian	Norway	0.46726190476190477
RT_STRING	0x278bd48	0x188	data	Polish	Poland	0.4489795918367347
RT_STRING	0x278bed0	0x14c	data	Portuguese	Brazil	0.4819277108433735
RT_STRING	0x278c01c	0x19e	data	Russian	Russia	0.5024154589371981
RT_STRING	0x278c1bc	0x168	data	Swedish	Sweden	0.4777777777777778
RT_STRING	0x278c324	0x142	data	Turkish	Turkey	0.531055900621118
RT_STRING	0x278c468	0x80	data	Chinese	China	0.765625
RT_STRING	0x278c4e8	0x152	data	Portuguese	Portugal	0.47928994082840237
RT_STRING	0x278c63c	0x162	data			0.423728813559322
RT_STRING	0x278c7a0	0x32	data	Arabic	Saudi Arabia	0.68
RT_STRING	0x278c7d4	0x28	data	Chinese	Taiwan	0.6
RT_STRING	0x278c7fc	0x40	data	Czech	Czech Republic	0.6875
RT_STRING	0x278c83c	0x40	data	Danish	Denmark	0.640625
RT_STRING	0x278c87c	0x3e	data	German	Germany	0.6774193548387096
RT_STRING	0x278c8bc	0x3a	data	Greek	Greece	0.7241379310344828
RT_STRING	0x278c8f8	0x32	data	English	United States	0.66
RT_STRING	0x278c92c	0x3e	data	Finnish	Finland	0.6290322580645161
RT_STRING	0x278c96c	0x3c	data	French	France	0.65
RT_STRING	0x278c9a8	0x32	data	Hebrew	Israel	0.66
RT_STRING	0x278c9dc	0x3c	data	Hungarian	Hungary	0.65
RT_STRING	0x278ca18	0x3e	data	Italian	Italy	0.6290322580645161
RT_STRING	0x278ca58	0x2e	data	Japanese	Japan	0.6739130434782609
RT_STRING	0x278ca88	0x2a	data	Korean	North Korea	0.6428571428571429
RT_STRING	0x278ca88	0x2a	data	Korean	South Korea	0.6428571428571429
RT_STRING	0x278cab4	0x30	data	Dutch	Netherlands	0.6458333333333334
RT_STRING	0x278cae4	0x30	data	Norwegian	Norway	0.625
RT_STRING	0x278cb14	0x3c	data	Polish	Poland	0.6333333333333333
RT_STRING	0x278cb50	0x3a	data	Portuguese	Brazil	0.6551724137931034
RT_STRING	0x278cb8c	0x38	data	Russian	Russia	0.6607142857142857
RT_STRING	0x278cbc4	0x2c	data	Swedish	Sweden	0.6136363636363636
RT_STRING	0x278cbf0	0x36	data	Turkish	Turkey	0.6111111111111112
RT_STRING	0x278cc28	0x28	data	Chinese	China	0.6
RT_STRING	0x278cc50	0x3e	data	Portuguese	Portugal	0.6612903225806451
RT_STRING	0x278cc90	0x40	data			0.640625
RT_STRING	0x278ccd0	0x7a	Matlab v4 mat-file (little endian) A\006-\0065\006 , numeric, rows 0, columns 0	Arabic	Saudi Arabia	0.6557377049180327
RT_STRING	0x278cd4c	0x40	Matlab v4 mat-file (little endian) ck(W\203c\317c\250`\204v\373\226f\201\010, numeric, rows 0, columns 0	Chinese	Taiwan	0.6875
RT_STRING	0x278cd8c	0x80	Matlab v4 mat-file (little endian) P, numeric, rows 0, columns 0	Czech	Czech Republic	0.6015625
RT_STRING	0x278ce0c	0x82	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Danish	Denmark	0.676923076923077
RT_STRING	0x278ce90	0x9e	Matlab v4 mat-file (little endian) C, numeric, rows 0, columns 0	German	Germany	0.6139240506329114
RT_STRING	0x278cf30	0x92	Matlab v4 mat-file (little endian) \223\003\257\003\275\003\265\003\304\003\261\003\271\003 , numeric, rows 0, columns 0	Greek	Greece	0.6575342465753424
RT_STRING	0x278cfc4	0x76	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	English	United States	0.6694915254237288
RT_STRING	0x278d03c	0x8a	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	Finnish	Finland	0.5942028985507246
RT_STRING	0x278d0c8	0x88	Matlab v4 mat-file (little endian) A, numeric, rows 0, columns 0	French	France	0.5808823529411765
RT_STRING	0x278d150	0x68	Matlab v4 mat-file (little endian) \341\005\325\005\350\005\347\005 , numeric, rows 0, columns 0	Hebrew	Israel	0.75
RT_STRING	0x278d1b8	0x8a	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Hungarian	Hungary	0.6666666666666666
RT_STRING	0x278d244	0x7a	Matlab v4 mat-file (little endian) A, numeric, rows 0, columns 0	Italian	Italy	0.5901639344262295
RT_STRING	0x278d2c0	0x56	Matlab v4 mat-file (little endian) \2630\3630\3240\3450\3740\2770\3740n0\2710\2550\3430\3630-N\016, numeric, rows 0, columns 0	Japanese	Japan	0.7441860465116279
RT_STRING	0x278d318	0x44	Matlab v4 mat-file (little endian) \364\316\350\3240\321 , numeric, rows 0, columns 0	Korean	North Korea	0.6911764705882353
RT_STRING	0x278d318	0x44	Matlab v4 mat-file (little endian) \364\316\350\3240\321 , numeric, rows 0, columns 0	Korean	South Korea	0.6911764705882353
RT_STRING	0x278d35c	0x84	Matlab v4 mat-file (little endian) C, numeric, rows 0, columns 0	Dutch	Netherlands	0.6742424242424242
RT_STRING	0x278d3e0	0x74	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Norwegian	Norway	0.6724137931034483
RT_STRING	0x278d454	0x76	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Polish	Poland	0.5677966101694916
RT_STRING	0x278d4cc	0x8c	Matlab v4 mat-file (little endian) E, numeric, rows 0, columns 0	Portuguese	Brazil	0.6642857142857143
RT_STRING	0x278d558	0x94	data	Russian	Russia	0.5135135135135135
RT_STRING	0x278d5ec	0x74	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	Swedish	Sweden	0.6810344827586207
RT_STRING	0x278d660	0x74	Matlab v4 mat-file (little endian) B, numeric, rows 0, columns 0	Turkish	Turkey	0.6206896551724138
RT_STRING	0x278d6d4	0x42	Matlab v4 mat-file (little endian) ck(Wkb\317c\250`\204v\241\213\227{:g\010, numeric, rows 0, columns 0	Chinese	China	0.7121212121212122
RT_STRING	0x278d718	0x82	Matlab v4 mat-file (little endian) A, numeric, rows 0, columns 0	Portuguese	Portugal	0.6230769230769231
RT_STRING	0x278d79c	0x7a	Matlab v4 mat-file (little endian) A, numeric, rows 0, columns 0			0.5901639344262295
RT_STRING	0x278d818	0x2c4	data	Arabic	Saudi Arabia	0.3968926553672316
RT_STRING	0x278dadc	0x162	data	Chinese	Taiwan	0.6412429378531074
RT_STRING	0x278dc40	0x2ea	data	Czech	Czech Republic	0.3967828418230563
RT_STRING	0x278df2c	0x37e	data	Danish	Denmark	0.348993288590604
RT_STRING	0x278e2ac	0x3d8	data	German	Germany	0.3648373983739837
RT_STRING	0x278e684	0x3f0	data	Greek	Greece	0.3551587301587302
RT_STRING	0x278ea74	0x392	data	English	United States	0.32166301969365424
RT_STRING	0x278ee08	0x32c	data	Finnish	Finland	0.3768472906403941
RT_STRING	0x278f134	0x3d0	data	French	France	0.32479508196721313
RT_STRING	0x278f504	0x276	data	Hebrew	Israel	0.40634920634920635
RT_STRING	0x278f77c	0x30a	data	Hungarian	Hungary	0.3856041131105398
RT_STRING	0x278fa88	0x320	data	Italian	Italy	0.39625
RT_STRING	0x278fda8	0x1e2	data	Japanese	Japan	0.5062240663900415
RT_STRING	0x278ff8c	0x1a4	data	Korean	North Korea	0.6214285714285714
RT_STRING	0x278ff8c	0x1a4	data	Korean	South Korea	0.6214285714285714
RT_STRING	0x2790130	0x39a	data	Dutch	Netherlands	0.3524945770065076
RT_STRING	0x27904cc	0x32a	data	Norwegian	Norway	0.3691358024691358
RT_STRING	0x27907f8	0x3a0	data	Polish	Poland	0.3642241379310345
RT_STRING	0x2790b98	0x3ce	data	Portuguese	Brazil	0.3182751540041068
RT_STRING	0x2790f68	0x36e	data	Russian	Russia	0.36104783599088835
RT_STRING	0x27912d8	0x384	data	Swedish	Sweden	0.37444444444444447
RT_STRING	0x279165c	0x340	data	Turkish	Turkey	0.3737980769230769
RT_STRING	0x279199c	0x15e	data	Chinese	China	0.5971428571428572
RT_STRING	0x2791afc	0x3b8	data	Portuguese	Portugal	0.328781512605042
RT_STRING	0x2791eb4	0x3f8	data			0.3228346456692913
RT_STRING	0x27922ac	0x4a	data	Arabic	Saudi Arabia	0.6891891891891891
RT_STRING	0x27922f8	0x30	data	Chinese	Taiwan	0.6666666666666666
RT_STRING	0x2792328	0x56	data	Czech	Czech Republic	0.686046511627907
RT_STRING	0x2792380	0x5c	data	Danish	Denmark	0.6739130434782609
RT_STRING	0x27923dc	0x6e	data	German	Germany	0.7181818181818181
RT_STRING	0x279244c	0x50	data	Greek	Greece	0.75
RT_STRING	0x279249c	0x4a	data	English	United States	0.6486486486486487
RT_STRING	0x27924e8	0x5e	data	Finnish	Finland	0.648936170212766
RT_STRING	0x2792548	0x58	data	French	France	0.6704545454545454
RT_STRING	0x27925a0	0x4e	data	Hebrew	Israel	0.7307692307692307
RT_STRING	0x27925f0	0x58	data	Hungarian	Hungary	0.6590909090909091
RT_STRING	0x2792648	0x58	data	Italian	Italy	0.6363636363636364
RT_STRING	0x27926a0	0x3e	data	Japanese	Japan	0.7419354838709677
RT_STRING	0x27926e0	0x30	data	Korean	North Korea	0.6666666666666666
RT_STRING	0x27926e0	0x30	data	Korean	South Korea	0.6666666666666666
RT_STRING	0x2792710	0x54	data	Dutch	Netherlands	0.6428571428571429
RT_STRING	0x2792764	0x52	data	Norwegian	Norway	0.6829268292682927
RT_STRING	0x27927b8	0x52	data	Polish	Poland	0.5975609756097561
RT_STRING	0x279280c	0x60	data	Portuguese	Brazil	0.65625
RT_STRING	0x279286c	0x5a	data	Russian	Russia	0.6666666666666666
RT_STRING	0x27928c8	0x62	data	Swedish	Sweden	0.673469387755102
RT_STRING	0x279292c	0x46	data	Turkish	Turkey	0.6285714285714286
RT_STRING	0x2792974	0x30	data	Chinese	China	0.6666666666666666
RT_STRING	0x27929a4	0x64	data	Portuguese	Portugal	0.65
RT_STRING	0x2792a08	0x64	data			0.65
RT_STRING	0x2792a6c	0xd2	data	Arabic	Saudi Arabia	0.4857142857142857
RT_STRING	0x2792b40	0x4e	data	Chinese	Taiwan	0.6153846153846154
RT_STRING	0x2792b90	0xda	data	Czech	Czech Republic	0.4908256880733945
RT_STRING	0x2792c6c	0xfa	data	Danish	Denmark	0.396
RT_STRING	0x2792d68	0xe6	data	German	Germany	0.44782608695652176
RT_STRING	0x2792e50	0xd6	data	Greek	Greece	0.5373831775700935
RT_STRING	0x2792f28	0xd0a	data	English	United States	0.4682444577591372
RT_STRING	0x2793c34	0xc8	data	Finnish	Finland	0.495
RT_STRING	0x2793cfc	0x110	data	French	France	0.39705882352941174
RT_STRING	0x2793e0c	0xa0	data	Hebrew	Israel	0.5125
RT_STRING	0x2793eac	0xf4	data	Hungarian	Hungary	0.5122950819672131
RT_STRING	0x2793fa0	0xce	data	Italian	Italy	0.45145631067961167
RT_STRING	0x2794070	0x9c	data	Japanese	Japan	0.5641025641025641
RT_STRING	0x279410c	0x72	data	Korean	North Korea	0.7105263157894737
RT_STRING	0x279410c	0x72	data	Korean	South Korea	0.7105263157894737
RT_STRING	0x2794180	0x106	data	Dutch	Netherlands	0.4083969465648855
RT_STRING	0x2794288	0xca	data	Norwegian	Norway	0.4603960396039604
RT_STRING	0x2794354	0xe6	data	Polish	Poland	0.4391304347826087
RT_STRING	0x279443c	0xf6	data	Portuguese	Brazil	0.4065040650406504
RT_STRING	0x2794534	0xd8	data	Russian	Russia	0.46296296296296297
RT_STRING	0x279460c	0xc8	data	Swedish	Sweden	0.455
RT_STRING	0x27946d4	0xc0	data	Turkish	Turkey	0.4739583333333333
RT_STRING	0x2794794	0x54	data	Chinese	China	0.6190476190476191
RT_STRING	0x27947e8	0x114	data	Portuguese	Portugal	0.4166666666666667
RT_STRING	0x27948fc	0xf6	data			0.4065040650406504
RT_STRING	0x27949f4	0xdd2	data	English	United States	0.38157150932730355
RT_STRING	0x27957c8	0xc0c	data	English	United States	0.5239948119325551
RT_STRING	0x27963d4	0xd3c	Targa image data - Color 1072 x 1093 x 32 +1083 +1075 "\257\0045\0044\004 "	English	United States	0.4542502951593861
RT_STRING	0x2797110	0xbac	data	English	United States	0.499665327978581
RT_STRING	0x2797cbc	0x396	data	English	United States	0.6285403050108932
RT_STRING	0x2798054	0x50	data	Arabic	Saudi Arabia	0.6625
RT_STRING	0x27980a4	0x30	data	Chinese	Taiwan	0.6666666666666666
RT_STRING	0x27980d4	0x60	data	Czech	Czech Republic	0.75
RT_STRING	0x2798134	0x6c	data	Danish	Denmark	0.6111111111111112
RT_STRING	0x27981a0	0x4e	data	German	Germany	0.6538461538461539
RT_STRING	0x27981f0	0x5a	data	Greek	Greece	0.7333333333333333
RT_STRING	0x279824c	0x2dc	data	English	United States	0.4959016393442623
RT_STRING	0x2798528	0x6e	data	Finnish	Finland	0.6545454545454545
RT_STRING	0x2798598	0x52	data	French	France	0.6463414634146342
RT_STRING	0x27985ec	0x42	data	Hebrew	Israel	0.7424242424242424
RT_STRING	0x2798630	0x5a	data	Hungarian	Hungary	0.7111111111111111
RT_STRING	0x279868c	0x4a	data	Italian	Italy	0.7027027027027027
RT_STRING	0x27986d8	0x4a	data	Japanese	Japan	0.7702702702702703
RT_STRING	0x2798724	0x3e	data	Korean	North Korea	0.7741935483870968
RT_STRING	0x2798724	0x3e	data	Korean	South Korea	0.7741935483870968
RT_STRING	0x2798764	0x60	data	Dutch	Netherlands	0.6770833333333334
RT_STRING	0x27987c4	0x46	data	Norwegian	Norway	0.6428571428571429
RT_STRING	0x279880c	0x4c	data	Polish	Poland	0.6973684210526315
RT_STRING	0x2798858	0x4a	data	Portuguese	Brazil	0.6351351351351351
RT_STRING	0x27988a4	0x5c	data	Russian	Russia	0.7391304347826086
RT_STRING	0x2798900	0x3a	data	Swedish	Sweden	0.6551724137931034
RT_STRING	0x279893c	0x56	data	Turkish	Turkey	0.6976744186046512
RT_STRING	0x2798994	0x3c	data	Chinese	China	0.75
RT_STRING	0x27989d0	0x4a	data	Portuguese	Portugal	0.6486486486486487
RT_STRING	0x2798a1c	0x42	data			0.6515151515151515
RT_STRING	0x2798a60	0x282	data	English	United States	0.7819314641744548
RT_STRING	0x2798ce4	0x2be	data	English	United States	0.603988603988604
RT_STRING	0x2798fa4	0x2ce	data	English	United States	0.6782729805013927
RT_STRING	0x2799274	0x1c6	data	English	United States	0.7026431718061674
RT_STRING	0x279943c	0x1d6	data	English	United States	0.5808510638297872
RT_STRING	0x2799614	0x36	Matlab v4 mat-file (little endian) F\006*\006'\006&\006,\006 , numeric, rows 0, columns 0	Arabic	Saudi Arabia	0.6851851851851852
RT_STRING	0x279964c	0x28	Matlab v4 mat-file (little endian) \203c\317cP}\234g, numeric, rows 0, columns 0	Chinese	Taiwan	0.6
RT_STRING	0x2799674	0x4a	Matlab v4 mat-file (little endian) V, numeric, rows 0, columns 0	Czech	Czech Republic	0.6756756756756757
RT_STRING	0x27996c0	0x3c	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Danish	Denmark	0.6333333333333333
RT_STRING	0x27996fc	0x4c	Matlab v4 mat-file (little endian) \334, numeric, rows 0, columns 0	German	Germany	0.6447368421052632
RT_STRING	0x2799748	0x48	Matlab v4 mat-file (little endian) \221\003\300\003\277\003\304\003\265\003\273\003\255\003\303\003\274\003\261\003\304\003\261\003 , numeric, rows 0, columns 0	Greek	Greece	0.7638888888888888
RT_STRING	0x2799790	0x1f0	data	English	United States	0.7701612903225806
RT_STRING	0x2799980	0x44	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	Finnish	Finland	0.6470588235294118
RT_STRING	0x27999c4	0x4c	Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0	French	France	0.6842105263157895
RT_STRING	0x2799a10	0x3a	Matlab v4 mat-file (little endian) \352\005\325\005\346\005\320\005\325\005\352\005 , numeric, rows 0, columns 0	Hebrew	Israel	0.7068965517241379
RT_STRING	0x2799a4c	0x46	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	Hungarian	Hungary	0.6
RT_STRING	0x2799a94	0x42	Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0	Italian	Italy	0.6212121212121212
RT_STRING	0x2799ad8	0x2c	Matlab v4 mat-file (little endian) \2710\2550\3430\3630P}\234g, numeric, rows 0, columns 0	Japanese	Japan	0.6363636363636364
RT_STRING	0x2799b04	0x2a	Matlab v4 mat-file (little endian) \200\254\254\300 , numeric, rows 0, columns 0	Korean	North Korea	0.6190476190476191
RT_STRING	0x2799b04	0x2a	Matlab v4 mat-file (little endian) \200\254\254\300 , numeric, rows 0, columns 0	Korean	South Korea	0.6190476190476191
RT_STRING	0x2799b30	0x56	Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0	Dutch	Netherlands	0.6744186046511628
RT_STRING	0x2799b88	0x3c	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Norwegian	Norway	0.6333333333333333
RT_STRING	0x2799bc4	0x42	Matlab v4 mat-file (little endian) W, numeric, rows 0, columns 0	Polish	Poland	0.6060606060606061
RT_STRING	0x2799c08	0x46	Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0	Portuguese	Brazil	0.6428571428571429
RT_STRING	0x2799c50	0x46	Matlab v4 mat-file (little endian) \0045\0047\004C\004;\004L\004B\0040\004B\004K\004 , numeric, rows 0, columns 0	Russian	Russia	0.7285714285714285
RT_STRING	0x2799c98	0x36	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Swedish	Sweden	0.6666666666666666
RT_STRING	0x2799cd0	0x40	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	Turkish	Turkey	0.640625
RT_STRING	0x2799d10	0x28	Matlab v4 mat-file (little endian) kb\317c\323~\234g, numeric, rows 0, columns 0	Chinese	China	0.6
RT_STRING	0x2799d38	0x4a	Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0	Portuguese	Portugal	0.6756756756756757
RT_STRING	0x2799d84	0x4e	Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0			0.6538461538461539
RT_STRING	0x2799dd4	0xa9e	data	Arabic	Saudi Arabia	0.14164827078734363
RT_STRING	0x279a874	0x54e	data	Chinese	Taiwan	0.21502209131075112
RT_STRING	0x279adc4	0xb66	data	Czech	Czech Republic	0.135709389993146
RT_STRING	0x279b92c	0xd90	data	Danish	Denmark	0.12269585253456221
RT_STRING	0x279c6bc	0xd9a	data	German	Germany	0.12492820218265364
RT_STRING	0x279d458	0xf20	data	Greek	Greece	0.12164256198347108
RT_STRING	0x279e378	0x1d8	data	English	United States	0.6334745762711864
RT_STRING	0x279e550	0xb5a	data	Finnish	Finland	0.12216104611149346
RT_STRING	0x279f0ac	0xd6e	data	French	France	0.12361838278068644
RT_STRING	0x279fe1c	0x9de	data	Hebrew	Israel	0.14489311163895488
RT_STRING	0x27a07fc	0xbdc	data	Hungarian	Hungary	0.13142292490118576
RT_STRING	0x27a13d8	0xbc2	data	Italian	Italy	0.13156146179401992
RT_STRING	0x27a1f9c	0x738	data	Japanese	Japan	0.19101731601731603
RT_STRING	0x27a26d4	0x6fc	data	Korean	North Korea	0.20246085011185683
RT_STRING	0x27a26d4	0x6fc	data	Korean	South Korea	0.20246085011185683
RT_STRING	0x27a2dd0	0xc60	data	Dutch	Netherlands	0.1268939393939394
RT_STRING	0x27a3a30	0xbc6	data	Norwegian	Norway	0.12508294625082947
RT_STRING	0x27a45f8	0xcbe	data	Polish	Poland	0.13059472716125076
RT_STRING	0x27a52b8	0xbfa	data	Portuguese	Brazil	0.13209393346379647
RT_STRING	0x27a5eb4	0xcc8	data	Russian	Russia	0.1311124694376528
RT_STRING	0x27a6b7c	0xb9c	data	Swedish	Sweden	0.12516823687752354
RT_STRING	0x27a7718	0xcac	data	Turkish	Turkey	0.11991368680641183
RT_STRING	0x27a83c4	0x520	data	Chinese	China	0.2149390243902439
RT_STRING	0x27a88e4	0xc50	data	Portuguese	Portugal	0.12277918781725888
RT_STRING	0x27a9534	0xbf8	data			0.12859007832898173
RT_STRING	0x27aa12c	0x1ca	data	English	United States	0.7183406113537117
RT_STRING	0x27aa2f8	0x21a	data	English	United States	0.6672862453531598
RT_STRING	0x27aa514	0x28e	data	English	United States	0.43577981651376146
RT_STRING	0x27aa7a4	0x27c	data	English	United States	0.7468553459119497
RT_STRING	0x27aaa20	0x2ae	data	English	United States	0.6749271137026239
RT_STRING	0x27aacd0	0x280	data	English	United States	0.6296875
RT_STRING	0x27aaf50	0x152	data	English	United States	0.7958579881656804
RT_STRING	0x27ab0a4	0xcc	data	English	United States	0.7401960784313726
RT_STRING	0x27ab170	0xd2	data	English	United States	0.8904761904761904
RT_STRING	0x27ab244	0xea	data	English	United States	0.8974358974358975
RT_STRING	0x27ab330	0xe8	data	English	United States	0.7931034482758621
RT_STRING	0x27ab418	0x372	data	Arabic	Saudi Arabia	0.34467120181405897
RT_STRING	0x27ab78c	0x136	data	Chinese	Taiwan	0.6548387096774193
RT_STRING	0x27ab8c4	0x3a6	data	Czech	Czech Republic	0.3222698072805139
RT_STRING	0x27abc6c	0x4a6	data	Danish	Denmark	0.3042016806722689
RT_STRING	0x27ac114	0x4de	data	German	Germany	0.3097913322632424
RT_STRING	0x27ac5f4	0x4ba	data	Greek	Greece	0.3074380165289256
RT_STRING	0x27acab0	0x124	data	English	United States	0.8561643835616438
RT_STRING	0x27acbd4	0x3b4	data	Finnish	Finland	0.310126582278481
RT_STRING	0x27acf88	0x488	data	French	France	0.30431034482758623
RT_STRING	0x27ad410	0x2d4	data	Hebrew	Israel	0.3674033149171271
RT_STRING	0x27ad6e4	0x3f0	data	Hungarian	Hungary	0.32837301587301587
RT_STRING	0x27adad4	0x402	data	Italian	Italy	0.3060428849902534
RT_STRING	0x27aded8	0x216	data	Japanese	Japan	0.49250936329588013
RT_STRING	0x27ae0f0	0x1dc	data	Korean	North Korea	0.5777310924369747
RT_STRING	0x27ae0f0	0x1dc	data	Korean	South Korea	0.5777310924369747
RT_STRING	0x27ae2cc	0x4ca	data	Dutch	Netherlands	0.2814029363784666
RT_STRING	0x27ae798	0x3a2	data	Norwegian	Norway	0.3053763440860215
RT_STRING	0x27aeb3c	0x458	data	Polish	Poland	0.32823741007194246
RT_STRING	0x27aef94	0x498	data	Portuguese	Brazil	0.2857142857142857
RT_STRING	0x27af42c	0x468	data	Russian	Russia	0.31117021276595747
RT_STRING	0x27af894	0x3fa	data	Swedish	Sweden	0.3055009823182711
RT_STRING	0x27afc90	0x412	data	Turkish	Turkey	0.2927063339731286
RT_STRING	0x27b00a4	0x11c	data	Chinese	China	0.6408450704225352
RT_STRING	0x27b01c0	0x414	data	Portuguese	Portugal	0.2883141762452107
RT_STRING	0x27b05d4	0x4b6	data			0.2752902155887231
RT_STRING	0x27b0a8c	0x20c	Targa image data - RLE 1083 x 1103 x 32 +1077 +1075 "A\0045\004."	English	United States	0.601145038167939
RT_STRING	0x27b0c98	0x21c	data	English	United States	0.6611111111111111
RT_STRING	0x27b0eb4	0x24c	data	English	United States	0.7261904761904762
RT_STRING	0x27b1100	0x1d2	data	English	United States	0.6609442060085837
RT_STRING	0x27b12d4	0x200	data	English	United States	0.75
RT_STRING	0x27b14d4	0x1be	Matlab v4 mat-file (little endian) (\006E\006'\006 , numeric, rows 0, columns 0	Arabic	Saudi Arabia	0.49551569506726456
RT_STRING	0x27b1694	0xd6	data	Chinese	Taiwan	0.8504672897196262
RT_STRING	0x27b176c	0x224	Matlab v4 mat-file (little endian) \341, numeric, rows 0, columns 0	Czech	Czech Republic	0.5218978102189781
RT_STRING	0x27b1990	0x270	Matlab v4 mat-file (little endian) \370, numeric, rows 0, columns 0	Danish	Denmark	0.42788461538461536
RT_STRING	0x27b1c00	0x27c	Matlab v4 mat-file (little endian) i, numeric, rows 0, columns 0	German	Germany	0.4308176100628931
RT_STRING	0x27b1e7c	0x27e	Matlab v4 mat-file (little endian) \261\003 , numeric, rows 0, columns 0	Greek	Greece	0.5031347962382445
RT_STRING	0x27b20fc	0x2ce	data	English	United States	0.564066852367688
RT_STRING	0x27b23cc	0x20e	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Finnish	Finland	0.4296577946768061
RT_STRING	0x27b25dc	0x270	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	French	France	0.4375
RT_STRING	0x27b284c	0x1ae	Matlab v4 mat-file (little endian) \331\005\352\005\333\005\337\005 , numeric, rows 0, columns 0	Hebrew	Israel	0.5372093023255814
RT_STRING	0x27b29fc	0x28e	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Hungarian	Hungary	0.47553516819571867
RT_STRING	0x27b2c8c	0x244	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Italian	Italy	0.45689655172413796
RT_STRING	0x27b2ed0	0x140	Matlab v4 mat-file (little endian) n0\3250\2410\2440\3530o0\0010\252`\017an0B0\2130\2750\3250\3100\2460\2470\2420k0\037a\323gW0f0D0\2130\357S\375\200'`L0B0\2120~0Y0\0020\3250\2410\2440\3530k0d0D0f0\037u\020bU0\2140_0, numeric, rows 0, columns 0	Japanese	Japan	0.7875
RT_STRING	0x27b3010	0x136	Matlab v4 mat-file (little endian) L\307 , numeric, rows 0, columns 0	Korean	North Korea	0.7870967741935484
RT_STRING	0x27b3010	0x136	Matlab v4 mat-file (little endian) L\307 , numeric, rows 0, columns 0	Korean	South Korea	0.7870967741935484
RT_STRING	0x27b3148	0x26c	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	Dutch	Netherlands	0.4064516129032258
RT_STRING	0x27b33b4	0x208	Matlab v4 mat-file (little endian) \370, numeric, rows 0, columns 0	Norwegian	Norway	0.4519230769230769
RT_STRING	0x27b35bc	0x268	Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0	Polish	Poland	0.461038961038961
RT_STRING	0x27b3824	0x260	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Portuguese	Brazil	0.43585526315789475
RT_STRING	0x27b3a84	0x22e	Matlab v4 mat-file (little endian) ;\0045\0044\004C\004N\004I\0048\0045\004 , numeric, rows 0, columns 0	Russian	Russia	0.489247311827957
RT_STRING	0x27b3cb4	0x24e	Matlab v4 mat-file (little endian) \366, numeric, rows 0, columns 0	Swedish	Sweden	0.43898305084745765
RT_STRING	0x27b3f04	0x23c	Matlab v4 mat-file (little endian) _\001a, numeric, rows 0, columns 0	Turkish	Turkey	0.4825174825174825
RT_STRING	0x27b4140	0xc2	data	Chinese	China	0.8711340206185567
RT_STRING	0x27b4204	0x25a	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Portuguese	Portugal	0.42857142857142855
RT_STRING	0x27b4460	0x254	Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0			0.4312080536912752
RT_STRING	0x27b46b4	0x298	data	English	United States	0.6204819277108434
RT_STRING	0x27b494c	0x278	data	English	United States	0.7848101265822784
RT_STRING	0x27b4bc4	0x2d2	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "8\011.\011M\011*\011(\011M\011(\011 "	English	United States	0.6481994459833795
RT_STRING	0x27b4e98	0x29a	data	English	United States	0.7087087087087087
RT_STRING	0x27b5134	0x488	data	English	United States	0.5198275862068965
RT_STRING	0x27b55bc	0x11c	data	Arabic	Saudi Arabia	0.545774647887324
RT_STRING	0x27b56d8	0x6c	data	Chinese	Taiwan	0.8425925925925926
RT_STRING	0x27b5744	0x158	data	Czech	Czech Republic	0.5494186046511628
RT_STRING	0x27b589c	0x15e	data	Danish	Denmark	0.5228571428571429
RT_STRING	0x27b59fc	0x18c	data	German	Germany	0.5050505050505051
RT_STRING	0x27b5b88	0x1a4	data	Greek	Greece	0.5333333333333333
RT_STRING	0x27b5d2c	0x476	data	English	United States	0.4956217162872154
RT_STRING	0x27b61a4	0x16c	data	Finnish	Finland	0.489010989010989
RT_STRING	0x27b6310	0x1b4	data	French	France	0.49311926605504586
RT_STRING	0x27b64c4	0xf6	data	Hebrew	Israel	0.5813008130081301
RT_STRING	0x27b65bc	0x18a	data	Hungarian	Hungary	0.5203045685279187
RT_STRING	0x27b6748	0x166	data	Italian	Italy	0.5111731843575419
RT_STRING	0x27b68b0	0xb8	data	Japanese	Japan	0.7880434782608695
RT_STRING	0x27b6968	0xbe	data	Korean	North Korea	0.8263157894736842
RT_STRING	0x27b6968	0xbe	data	Korean	South Korea	0.8263157894736842
RT_STRING	0x27b6a28	0x18e	data	Dutch	Netherlands	0.4623115577889447
RT_STRING	0x27b6bb8	0x150	data	Norwegian	Norway	0.5178571428571429
RT_STRING	0x27b6d08	0x162	data	Polish	Poland	0.5508474576271186
RT_STRING	0x27b6e6c	0x170	data	Portuguese	Brazil	0.5054347826086957
RT_STRING	0x27b6fdc	0x14a	data	Russian	Russia	0.5515151515151515
RT_STRING	0x27b7128	0xfa	data	Swedish	Sweden	0.556
RT_STRING	0x27b7224	0x15c	data	Turkish	Turkey	0.5373563218390804
RT_STRING	0x27b7380	0x76	data	Chinese	China	0.8813559322033898
RT_STRING	0x27b73f8	0x17e	data	Portuguese	Portugal	0.5026178010471204
RT_STRING	0x27b7578	0x154	data			0.5058823529411764
RT_STRING	0x27b76cc	0x49c	data	English	United States	0.6466101694915254
RT_STRING	0x27b7b68	0x456	data	English	United States	0.5540540540540541
RT_STRING	0x27b7fc0	0x3f8	data	English	United States	0.5974409448818898
RT_STRING	0x27b83b8	0x460	data	English	United States	0.575
RT_STRING	0x27b8818	0x4b4	data	English	United States	0.46677740863787376
RT_STRING	0x27b8ccc	0x478	data	English	United States	0.6354895104895105
RT_STRING	0x27b9144	0x470	data	English	United States	0.5598591549295775
RT_STRING	0x27b95b4	0x41c	data	English	United States	0.5807984790874525
RT_STRING	0x27b99d0	0x426	data	English	United States	0.5790960451977402
RT_STRING	0x27b9df8	0x488	data	English	United States	0.45775862068965517
RT_STRING	0x27ba280	0x424	data	English	United States	0.6490566037735849
RT_STRING	0x27ba6a4	0x42c	data	English	United States	0.5608614232209738
RT_STRING	0x27baad0	0x43a	data	English	United States	0.6090573012939002
RT_STRING	0x27baf0c	0x43c	data	English	United States	0.6199261992619927
RT_STRING	0x27bb348	0x59c	data	English	United States	0.435933147632312
RT_STRING	0x27bb8e4	0x500	Targa image data - Color 2379 x 2337 x 32 +2344 +2354 "\025\011@\011 "	English	United States	0.6640625
RT_STRING	0x27bbde4	0x59c	data	English	United States	0.5682451253481894
RT_STRING	0x27bc380	0x536	data	English	United States	0.5907046476761619
RT_STRING	0x27bc8b8	0x8e6	data	English	United States	0.5258999122036875
RT_STRING	0x27bd1a0	0xc92	data	English	United States	0.3334369173399627
RT_STRING	0x27bde34	0xbf4	data	English	United States	0.5320261437908497
RT_STRING	0x27bea28	0xc5e	data	English	United States	0.48673404927353126
RT_STRING	0x27bf688	0xcd8	data	English	United States	0.4382603406326034
RT_STRING	0x27c0360	0x92c	data	English	United States	0.5404599659284497
RT_STRING	0x27c0c8c	0x9ce	data	English	United States	0.3669322709163347
RT_STRING	0x27c165c	0x962	data	English	United States	0.5104079933388843
RT_STRING	0x27c1fc0	0x986	data	English	United States	0.5332239540607056
RT_STRING	0x27c2948	0x9d8	data	English	United States	0.4765873015873016
RT_STRING	0x27c3320	0x8ec	data	English	United States	0.563922942206655
RT_STRING	0x27c3c0c	0xcc6	data	English	United States	0.382262996941896
RT_STRING	0x27c48d4	0xca8	data	English	United States	0.4367283950617284
RT_STRING	0x27c557c	0xcbe	data	English	United States	0.5076640098099325
RT_STRING	0x27c623c	0xd0c	data	English	United States	0.4224550898203593
RT_STRING	0x27c6f48	0x8a6	data	English	United States	0.5519421860885275
RT_STRING	0x27c77f0	0x256	data	English	United States	0.4983277591973244
RT_STRING	0x27c7a48	0x260	data	English	United States	0.5444078947368421
RT_STRING	0x27c7ca8	0x22e	data	English	United States	0.6505376344086021
RT_STRING	0x27c7ed8	0x23a	data	English	United States	0.5333333333333333
RT_STRING	0x27c8114	0x1e6	data	English	United States	0.6296296296296297
RT_STRING	0x27c82fc	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x27c83dc	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x27c84bc	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x27c859c	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x27c867c	0xe0	data	English	United States	0.10714285714285714
RT_STRING	0x27c875c	0x2f4	AmigaOS bitmap font "f", fc_YSize 14848, 16640 elements, 2nd "$", 3rd "n"	English	United States	0.6362433862433863
RT_STRING	0x27c8a50	0x314	data	English	United States	0.47588832487309646
RT_STRING	0x27c8d64	0x2d0	data	English	United States	0.6777777777777778
RT_STRING	0x27c9034	0x2fa	data	English	United States	0.5931758530183727
RT_STRING	0x27c9330	0x2fa	data	English	United States	0.6286089238845144
RT_STRING	0x27c962c	0x2ea	data	English	United States	0.6005361930294906
RT_STRING	0x27c9918	0x2de	data	English	United States	0.44005449591280654
RT_STRING	0x27c9bf8	0x296	data	English	United States	0.676737160120846
RT_STRING	0x27c9e90	0x2f6	data	English	United States	0.5620052770448549
RT_STRING	0x27ca188	0x2f4	data	English	United States	0.623015873015873
RT_STRING	0x27ca47c	0x25a	data	English	United States	0.6495016611295681
RT_STRING	0x27ca6d8	0x2ba	data	English	United States	0.4355300859598854
RT_STRING	0x27ca994	0x26e	data	English	United States	0.7138263665594855
RT_STRING	0x27cac04	0x29a	data	English	United States	0.581081081081081
RT_STRING	0x27caea0	0x280	data	English	United States	0.5953125
RT_STRING	0x27cb120	0x2c6	data	English	United States	0.647887323943662
RT_STRING	0x27cb3e8	0x328	data	English	United States	0.44925742574257427
RT_STRING	0x27cb710	0x320	data	English	United States	0.6825
RT_STRING	0x27cba30	0x350	data	English	United States	0.6096698113207547
RT_STRING	0x27cbd80	0x37e	data	English	United States	0.5391498881431768
RT_STRING	0x27cc100	0x37c	data	English	United States	0.6390134529147982
RT_STRING	0x27cc47c	0x478	data	English	United States	0.42395104895104896
RT_STRING	0x27cc8f4	0x462	data	English	United States	0.5811051693404634
RT_STRING	0x27ccd58	0x400	data	English	United States	0.6123046875
RT_STRING	0x27cd158	0x4b0	data	English	United States	0.5016666666666667
RT_STRING	0x27cd608	0x276	data	English	United States	0.6825396825396826
RT_STRING	0x27cd880	0xd0	data	English	United States	0.7836538461538461
RT_STRING	0x27cd950	0xca	data	English	United States	0.8613861386138614
RT_STRING	0x27cda1c	0xdc	data	English	United States	0.9045454545454545
RT_STRING	0x27cdaf8	0xd8	data	English	United States	0.7268518518518519
RT_STRING	0x27cdbd0	0x306	data	English	United States	0.6950904392764858
RT_STRING	0x27cded8	0xbc4	data	English	United States	0.42363877822045154
RT_STRING	0x27cea9c	0xba2	data	English	United States	0.46474143720617866
RT_STRING	0x27cf640	0xac8	data	English	United States	0.5876811594202899
RT_STRING	0x27d0108	0xb36	data	English	United States	0.47560975609756095
RT_STRING	0x27d0c40	0x8d6	data	English	United States	0.5742705570291777
RT_STRING	0x27d1518	0x220	AmigaOS bitmap font ",\0061\006J\006 ", fc_YSize 26880, 10758 elements, 2nd "l", 3rd "i"	English	United States	0.6066176470588235
RT_STRING	0x27d1738	0x20a	data	English	United States	0.6264367816091954
RT_STRING	0x27d1944	0x232	data	English	United States	0.7633451957295374
RT_STRING	0x27d1b78	0x202	data	English	United States	0.6108949416342413
RT_STRING	0x27d1d7c	0x1f6	data	English	United States	0.6852589641434262
RT_STRING	0x27d1f74	0x2e4	data	English	United States	0.6
RT_STRING	0x27d2258	0x32c	data	English	United States	0.5517241379310345
RT_STRING	0x27d2584	0x2b0	data	English	United States	0.7659883720930233
RT_STRING	0x27d2834	0x2e6	data	English	United States	0.6145552560646901
RT_STRING	0x27d2b1c	0x2a8	data	English	United States	0.6838235294117647
RT_STRING	0x27d2dc4	0x256	data	English	United States	0.5836120401337793
RT_STRING	0x27d301c	0x288	data	English	United States	0.4521604938271605
RT_STRING	0x27d32a4	0x226	data	English	United States	0.6854545454545454
RT_STRING	0x27d34cc	0x206	data	English	United States	0.527027027027027
RT_STRING	0x27d36d4	0x26c	data	English	United States	0.6193548387096774
RT_STRING	0x27d3940	0x5f6	data	English	United States	0.5321100917431193
RT_STRING	0x27d3f38	0x820	data	English	United States	0.35865384615384616
RT_STRING	0x27d4758	0x70a	data	English	United States	0.5832408435072142
RT_STRING	0x27d4e64	0x7f2	data	English	United States	0.47000983284169123
RT_STRING	0x27d5658	0x76a	data	English	United States	0.5068493150684932
RT_STRING	0x27d5dc4	0x7ce	data	English	United States	0.5125125125125125
RT_STRING	0x27d6594	0xa82	data	English	United States	0.3252788104089219
RT_STRING	0x27d7018	0x9ce	data	English	United States	0.5091633466135458
RT_STRING	0x27d79e8	0xa2e	data	English	United States	0.4716039907904835
RT_STRING	0x27d8418	0xa44	data	English	United States	0.4257990867579909
RT_STRING	0x27d8e5c	0x464	Targa image data - Color 1089 x 1103 x 32 +1083 +1072 "?\004>\004<\0048\004;\004:\0040\004."	English	United States	0.604982206405694
RT_STRING	0x27d92c0	0x212	data	English	United States	0.4830188679245283
RT_STRING	0x27d94d4	0x1d4	AmigaOS bitmap font "n", fc_YSize 30725, 18688 elements, 2nd "t\005& \013", 3rd	English	United States	0.6645299145299145
RT_STRING	0x27d96a8	0x20a	data	English	United States	0.6800766283524904
RT_STRING	0x27d98b4	0x210	data	English	United States	0.5852272727272727
RT_STRING	0x27d9ac4	0x3aa	AmigaOS bitmap font "3\016%\0161\016\007\016\025\0164\016\024\016\025\0161\016I\016\007\016.", fc_YSize 25856, 270 elements, 2nd "C", 3rd "%\0065\006/\006'\0061\006K\006'\006 "	English	United States	0.5565031982942431
RT_STRING	0x27d9e70	0x710	data	English	United States	0.3407079646017699
RT_STRING	0x27da580	0x79c	data	English	United States	0.4029774127310062
RT_STRING	0x27dad1c	0x848	data	English	United States	0.45943396226415095
RT_STRING	0x27db564	0x728	data	English	United States	0.36899563318777295
RT_STRING	0x27dbc8c	0x5f4	data	English	United States	0.4678477690288714
RT_STRING	0x27dc280	0x350	data	English	United States	0.5283018867924528
RT_STRING	0x27dc5d0	0x37e	data	English	United States	0.5760626398210291
RT_STRING	0x27dc950	0x320	data	English	United States	0.69125
RT_STRING	0x27dcc70	0x368	data	English	United States	0.5538990825688074
RT_STRING	0x27dcfd8	0x30c	data	English	United States	0.6641025641025641
RT_STRING	0x27dd2e4	0x80a	data	English	United States	0.49173955296404276
RT_STRING	0x27ddaf0	0x7ce	data	English	United States	0.4934934934934935
RT_STRING	0x27de2c0	0x64c	data	English	United States	0.6625310173697271
RT_STRING	0x27de90c	0x79a	data	English	United States	0.5190133607399794
RT_STRING	0x27df0a8	0x640	data	English	United States	0.595
RT_STRING	0x27df6e8	0x52a	data	English	United States	0.5612708018154312
RT_STRING	0x27dfc14	0x5a0	data	English	United States	0.4888888888888889
RT_STRING	0x27e01b4	0x498	data	English	United States	0.6870748299319728
RT_STRING	0x27e064c	0x546	Targa image data - Color 1072 x 1078 x 32 +1083 +1075 "G\0040\0044\004A\0040\004=\0043\004\257\0049\004."	English	United States	0.5733333333333334
RT_STRING	0x27e0b94	0x4a6	data	English	United States	0.6226890756302521
RT_STRING	0x27e103c	0x80a	data	English	United States	0.5262390670553936
RT_STRING	0x27e1848	0x95e	data	English	United States	0.390325271059216
RT_STRING	0x27e21a8	0x792	data	English	United States	0.6062951496388029
RT_STRING	0x27e293c	0x896	data	English	United States	0.4899909008189263
RT_STRING	0x27e31d4	0x87e	data	English	United States	0.547378104875805
RT_STRING	0x27e3a54	0x82e	data	English	United States	0.543935052531041
RT_STRING	0x27e4284	0xaae	data	English	United States	0.35515727871250913
RT_STRING	0x27e4d34	0x96a	data	English	United States	0.549792531120332
RT_STRING	0x27e56a0	0xa08	data	English	United States	0.470404984423676
RT_STRING	0x27e60a8	0x9fe	data	English	United States	0.4980453479280688
RT_STRING	0x27e6aa8	0x304	data	English	United States	0.6282383419689119
RT_STRING	0x27e6dac	0x142	data	English	United States	0.5341614906832298
RT_STRING	0x27e6ef0	0x10e	data	English	United States	0.8740740740740741
RT_STRING	0x27e7000	0x16c	data	English	United States	0.7307692307692307
RT_STRING	0x27e716c	0x140	data	English	United States	0.7
RT_STRING	0x27e72ac	0x586	data	English	United States	0.574964639321075
RT_STRING	0x27e7834	0xc0a	data	English	United States	0.36632057105775473
RT_STRING	0x27e8440	0xbbe	data	English	United States	0.49933466400532267
RT_STRING	0x27e9000	0xad6	data	English	United States	0.5475847152126893
RT_STRING	0x27e9ad8	0xb66	data	English	United States	0.4609321453050034
RT_STRING	0x27ea640	0xa64	data	English	United States	0.5789473684210527
RT_STRING	0x27eb0a4	0xde2	data	English	United States	0.4127743387732133
RT_STRING	0x27ebe88	0xd9c	data	English	United States	0.46039035591274396
RT_STRING	0x27ecc24	0xe30	data	English	United States	0.5341409691629956
RT_STRING	0x27eda54	0xeb4	data	English	United States	0.4585547290116897
RT_STRING	0x27ee908	0x99c	data	English	United States	0.582520325203252
RT_STRING	0x27ef2a4	0x3d2	data	English	United States	0.5224948875255624
RT_STRING	0x27ef678	0x3be	data	English	United States	0.5845511482254697
RT_STRING	0x27efa38	0x2d2	data	English	United States	0.7686980609418282
RT_STRING	0x27efd0c	0x3ae	data	English	United States	0.5859872611464968
RT_STRING	0x27f00bc	0x3d6	data	English	United States	0.6446028513238289
RT_STRING	0x27f0494	0xa3a	data	English	United States	0.45110771581359815
RT_STRING	0x27f0ed0	0xa06	data	English	United States	0.44232268121590024
RT_STRING	0x27f18d8	0x8f8	data	English	United States	0.5971254355400697
RT_STRING	0x27f21d0	0x9aa	data	English	United States	0.4773645917542441
RT_STRING	0x27f2b7c	0x852	data	English	United States	0.5629107981220657
RT_STRING	0x27f33d0	0x282	data	English	United States	0.6682242990654206
RT_STRING	0x27f3654	0x2c0	data	English	United States	0.5582386363636364
RT_STRING	0x27f3914	0x276	data	English	United States	0.7793650793650794
RT_STRING	0x27f3b8c	0x2a4	data	English	United States	0.643491124260355
RT_STRING	0x27f3e30	0x278	data	English	United States	0.7104430379746836
RT_STRING	0x27f40a8	0x226	data	English	United States	0.7127272727272728
RT_STRING	0x27f42d0	0x252	data	English	United States	0.5589225589225589
RT_STRING	0x27f4524	0x224	data	English	United States	0.8029197080291971
RT_STRING	0x27f4748	0x278	data	English	United States	0.6329113924050633
RT_STRING	0x27f49c0	0x272	data	English	United States	0.7060702875399361
RT_STRING	0x27f4c34	0x628	data	English	United States	0.565989847715736
RT_STRING	0x27f525c	0x8a8	data	English	United States	0.4056859205776173
RT_STRING	0x27f5b04	0x814	data	English	United States	0.6276595744680851
RT_STRING	0x27f6318	0x7f0	data	English	United States	0.514763779527559
RT_STRING	0x27f6b08	0x82a	data	English	United States	0.561244019138756
RT_STRING	0x27f7334	0x3ba	data	English	United States	0.6666666666666666
RT_STRING	0x27f76f0	0x2a0	data	English	United States	0.4568452380952381
RT_STRING	0x27f7990	0x2c2	data	English	United States	0.7407932011331445
RT_STRING	0x27f7c54	0x2f2	data	English	United States	0.6790450928381963
RT_STRING	0x27f7f48	0x2b8	data	English	United States	0.6379310344827587
RT_STRING	0x27f8200	0x6bc	data	English	United States	0.584106728538283
RT_STRING	0x27f88bc	0xb58	data	English	United States	0.39979338842975204
RT_STRING	0x27f9414	0xb90	data	English	United States	0.518918918918919
RT_STRING	0x27f9fa4	0xbae	data	English	United States	0.5428093645484949
RT_STRING	0x27fab54	0xcae	data	English	United States	0.4698089956869994
RT_STRING	0x27fb804	0x9c8	data	English	United States	0.5599041533546326
RT_STRING	0x27fc1cc	0xab4	data	English	United States	0.4332116788321168
RT_STRING	0x27fcc80	0xac4	data	English	United States	0.4923802612481858
RT_STRING	0x27fd744	0xb02	data	English	United States	0.5603264726756565
RT_STRING	0x27fe248	0xb9a	data	English	United States	0.4663299663299663
RT_STRING	0x27fede4	0x96a	data	English	United States	0.5763485477178423
RT_STRING	0x27ff750	0xaca	data	English	United States	0.44243301955104997
RT_STRING	0x280021c	0xb2e	data	English	United States	0.4723969252271139
RT_STRING	0x2800d4c	0xa48	data	English	United States	0.5858662613981763
RT_STRING	0x2801794	0xb9a	data	English	United States	0.4717171717171717
RT_STRING	0x2802330	0x94e	data	English	United States	0.5541561712846348
RT_STRING	0x2802c80	0x7c2	data	English	United States	0.4778449144008056
RT_STRING	0x2803444	0x7b0	data	English	United States	0.46646341463414637
RT_STRING	0x2803bf4	0x716	data	English	United States	0.6119073869900772
RT_STRING	0x280430c	0x794	data	English	United States	0.5195876288659794
RT_STRING	0x2804aa0	0x63e	data	English	United States	0.6007509386733417
RT_STRING	0x28050e0	0x826	data	English	United States	0.5158197507190796
RT_STRING	0x2805908	0x8c6	data	English	United States	0.4238646482635797
RT_STRING	0x28061d0	0x7c6	data	English	United States	0.6025125628140704
RT_STRING	0x2806998	0x830	data	English	United States	0.5076335877862596
RT_STRING	0x28071c8	0x79a	data	English	United States	0.5544707091469682
RT_STRING	0x2807964	0x7ec	data	English	United States	0.5404339250493096
RT_STRING	0x2808150	0x854	data	English	United States	0.39634146341463417
RT_STRING	0x28089a4	0x796	data	English	United States	0.5983522142121525
RT_STRING	0x280913c	0x842	data	English	United States	0.4910122989593188
RT_STRING	0x2809980	0x80c	data	English	United States	0.5461165048543689
RT_STRING	0x280a18c	0x1a0	data	English	United States	0.78125
RT_STRING	0x280a32c	0xd4	data	English	United States	0.7028301886792453
RT_STRING	0x280a400	0xc4	data	English	United States	0.9489795918367347
RT_STRING	0x280a4c4	0xfa	data	English	United States	0.808
RT_STRING	0x280a5c0	0xe2	data	English	United States	0.8362831858407079
RT_STRING	0x280a6a4	0x298	data	English	United States	0.6265060240963856
RT_STRING	0x280a93c	0x3a0	data	English	United States	0.4364224137931034
RT_STRING	0x280acdc	0x362	data	English	United States	0.6697459584295612
RT_STRING	0x280b040	0x3be	data	English	United States	0.5772442588726514
RT_STRING	0x280b400	0x38c	data	English	United States	0.5605726872246696
RT_STRING	0x280b78c	0x31e	data	English	United States	0.656641604010025
RT_STRING	0x280baac	0x2ec	data	English	United States	0.4625668449197861
RT_STRING	0x280bd98	0x37c	data	English	United States	0.6233183856502242
RT_STRING	0x280c114	0x38c	data	English	United States	0.6420704845814978
RT_STRING	0x280c4a0	0x33e	data	English	United States	0.5927710843373494
RT_STRING	0x280c7e0	0x178	data	English	United States	0.7393617021276596
RT_GROUP_ICON	0x280c958	0x5a	data	English	United States	0.7333333333333333
RT_VERSION	0x280c9b4	0x3e8	data	English	United States	0.393

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
msvcrt.dll	___lc_codepage_func

Exports

Name	Ordinal	Address
_cgo_dummy_export	1	0x141137650
secp256k1GoPanicError	2	0x140869930
secp256k1GoPanicIllegal	3	0x1408698e0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Arabic	Saudi Arabia
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hebrew	Israel
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Russian	Russia
Swedish	Sweden
Turkish	Turkey
Chinese	China
Portuguese	Portugal

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 12, 2024 08:42:29.364041090 CEST	49707	443	192.168.2.5	193.3.19.110
Jul 12, 2024 08:42:29.364108086 CEST	443	49707	193.3.19.110	192.168.2.5
Jul 12, 2024 08:42:29.364274979 CEST	49707	443	192.168.2.5	193.3.19.110
Jul 12, 2024 08:42:29.364589930 CEST	49707	443	192.168.2.5	193.3.19.110
Jul 12, 2024 08:42:29.364609957 CEST	443	49707	193.3.19.110	192.168.2.5
Jul 12, 2024 08:42:29.364756107 CEST	443	49707	193.3.19.110	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 12, 2024 08:42:49.987090111 CEST	53	57686	162.159.36.2	192.168.2.5
Jul 12, 2024 08:42:50.460619926 CEST	52388	53	192.168.2.5	1.1.1.1
Jul 12, 2024 08:42:50.475339890 CEST	53	52388	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 12, 2024 08:42:50.460619926 CEST	192.168.2.5	1.1.1.1	0x44ee	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 12, 2024 08:42:50.475339890 CEST	1.1.1.1	192.168.2.5	0x44ee	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	02:42:21
Start date:	12/07/2024
Path:	C:\Users\user\Desktop\BrowserUpdate.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\BrowserUpdate.exe"
Imagebase:	0x7ff7e2350000
File size:	55'469'264 bytes
MD5 hash:	696B3679926998B45C806A1068FFCB75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_MicroClip, Description: Yara detected MicroClip, Source: 00000000.00000002.2205746713.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MicroClip, Description: Yara detected MicroClip, Source: 00000000.00000000.2108717389.00007FF7E2DC8000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BrowserUpdate.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
BrowserUpdate.exe