Edit tour

Windows Analysis Report
https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24

Overview

General Information

Sample URL:	https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24
Analysis ID:	1416048
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Drops PE files

One or more processes crash

Stores files to the Windows start menu directory

Tries to load missing DLLs

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Sample crashes during execution, try analyze it on another analysis machine

Process Tree

System is w10x64_ra

chrome.exe (PID: 5672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1808,i,10677026892374518839,1669083634398148650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5732 --field-trial-handle=1808,i,10677026892374518839,1669083634398148650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 7632 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

Basketball court short version 3-18-24.exe (PID: 7824 cmdline: "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe" MD5: 14B4281E33D39A0A1C20A46608D7D5C4)

WerFault.exe (PID: 7924 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7824 -s 572 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Basketball court short version 3-18-24.exe (PID: 8160 cmdline: "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe" MD5: 14B4281E33D39A0A1C20A46608D7D5C4)

WerFault.exe (PID: 1288 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8160 -s 560 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Basketball court short version 3-18-24.exe (PID: 7360 cmdline: "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe" MD5: 14B4281E33D39A0A1C20A46608D7D5C4)

WerFault.exe (PID: 7004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 572 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Basketball court short version 3-18-24.exe (PID: 6572 cmdline: "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe" MD5: 14B4281E33D39A0A1C20A46608D7D5C4)

WerFault.exe (PID: 640 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 572 MD5: C31336C1EFC2CCB44B4326EA793040F2)

7zFM.exe (PID: 4112 cmdline: "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe" MD5: 30AC0B832D75598FB3EC37B6F2A8C86A)

Basketball court short version 3-18-24.exe (PID: 2408 cmdline: "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe" MD5: 14B4281E33D39A0A1C20A46608D7D5C4)

WerFault.exe (PID: 2064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 560 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdrive.google.com%2Fdrivesharing%2Fclientmodel%3Fid%3D1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps%3A%2F%2Fdrive.google.com&followup=https%3A%2F%2Fdrive.google.com%2Fdrivesharing%2Fclientmodel%3Fid%3D1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps%3A%2F%2Fdrive.google.com&ifkv=ARZ0qKKIpJOXLsFYx-wNhR9C0nUgdeiFu_vebnODkT3trolkokdTT4j19fLE3fEEjnIlaiXZQ4ALtA&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1810983846%3A1711477513284007&theme=mn&ddm=0

HTTP Parser: No favicon

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7824 -s 572

Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: glu32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: pdh.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: winmm.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: glu32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: pdh.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: winmm.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: glu32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: pdh.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: winmm.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: glu32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: pdh.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: winmm.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: textshaping.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wldp.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: profapi.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: propsys.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: explorerframe.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zFM.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: glu32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: pdh.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: opengl32.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Section loaded: winmm.dll

Source: classification engine

Classification label: clean2.win@32/54@26/151

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7360
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6572
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8160
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2408
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7824

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ca6347bf-4814-4409-8d13-17aa3c3b27eb

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1808,i,10677026892374518839,1669083634398148650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1808,i,10677026892374518839,1669083634398148650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5732 --field-trial-handle=1808,i,10677026892374518839,1669083634398148650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5732 --field-trial-handle=1808,i,10677026892374518839,1669083634398148650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe"
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7824 -s 572
Source: unknown	Process created: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe"
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8160 -s 560
Source: unknown	Process created: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe"
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 572
Source: unknown	Process created: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe"
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 572
Source: unknown	Process created: C:\Program Files\7-Zip\7zFM.exe "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe"
Source: unknown	Process created: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe "C:\Users\user\Downloads\Basketball court short version 3-18-24.exe"
Source: C:\Users\user\Downloads\Basketball court short version 3-18-24.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 560
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\7-Zip\7zFM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\Unconfirmed 75163.crdownload

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Rundll32	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
about:blank	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
blobcomments-pa.clients6.google.com	142.251.16.95	true	false	high
play.google.com	142.251.111.101	true	false	high
plus.l.google.com	172.253.122.138	true	false	high
drive.google.com	172.253.115.101	true	false	high
www.google.com	172.253.115.99	true	false	high
googlehosted.l.googleusercontent.com	142.251.163.132	true	false	high
drive-thirdparty.googleusercontent.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://drive.google.com/auth_warmup	false		high
about:blank	false	Avira URL Cloud: safe	low
https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.179.94	unknown	United States	15169	GOOGLEUS	false
142.251.111.101	play.google.com	United States	15169	GOOGLEUS	false
172.253.122.138	plus.l.google.com	United States	15169	GOOGLEUS	false
172.253.62.94	unknown	United States	15169	GOOGLEUS	false
172.253.63.139	unknown	United States	15169	GOOGLEUS	false
172.253.62.95	unknown	United States	15169	GOOGLEUS	false
52.182.143.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.253.122.113	unknown	United States	15169	GOOGLEUS	false
142.251.167.94	unknown	United States	15169	GOOGLEUS	false
172.253.115.99	www.google.com	United States	15169	GOOGLEUS	false
172.253.115.101	drive.google.com	United States	15169	GOOGLEUS	false
20.42.73.29	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.179.101	unknown	United States	15169	GOOGLEUS	false
172.253.115.94	unknown	United States	15169	GOOGLEUS	false
142.251.163.94	unknown	United States	15169	GOOGLEUS	false
172.253.62.101	unknown	United States	15169	GOOGLEUS	false
142.251.163.95	unknown	United States	15169	GOOGLEUS	false
142.251.111.99	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.251.167.132	unknown	United States	15169	GOOGLEUS	false
142.251.163.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.253.63.95	unknown	United States	15169	GOOGLEUS	false
20.189.173.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.253.63.94	unknown	United States	15169	GOOGLEUS	false
142.251.111.94	unknown	United States	15169	GOOGLEUS	false
172.253.63.100	unknown	United States	15169	GOOGLEUS	false
20.189.173.22	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.253.63.132	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.16.95	blobcomments-pa.clients6.google.com	United States	15169	GOOGLEUS	false
142.251.16.94	unknown	United States	15169	GOOGLEUS	false
172.253.115.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1416048
Start date and time:	2024-03-26 19:24:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@32/54@26/151

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.111.94, 142.251.179.101, 142.251.179.113, 142.251.179.138, 142.251.179.139, 142.251.179.102, 142.251.179.100, 172.253.115.84, 34.104.35.123, 142.251.16.95, 142.251.179.94, 172.253.63.94, 172.253.115.94, 142.251.163.95, 142.251.111.95, 172.253.115.95, 172.253.62.95, 142.251.167.95, 172.253.63.95, 172.253.122.95, 142.251.179.95, 142.250.31.95
Excluded domains from analysis (whitelisted): fonts.googleapis.com, ssl.gstatic.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, fonts.gstatic.com, content.googleapis.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_01b8f5a5-bc66-45ef-aa18-8c689e24d4c3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8791187588972582
Encrypted:	false
SSDEEP:
MD5:	79D8F6D58F169F749A9877D1453FFA4A
SHA1:	BA4E741E95438FAF741F144FE82CE2F22BE72546
SHA-256:	3A2AB1F40F5B63E876CE4BE928B0BAF263F4885D0F78F255898C0F9D184EB4AE
SHA-512:	12A1F86FD28BC280D67060008E16E5686663C828CA6EA995CB8F4FFA28FCAF5683EBBA1E1616040FE158DEA2B3844548F65505379F0A7A7FA889322E8D669876
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.5.9.5.1.1.6.7.4.9.5.6.3.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.5.9.5.1.1.6.8.7.1.7.6.2.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.b.8.f.5.a.5.-.b.c.6.6.-.4.5.e.f.-.a.a.1.8.-.8.c.6.8.9.e.2.4.d.4.c.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.3.c.7.e.e.6.8.-.a.4.a.9.-.4.8.9.f.-.9.c.8.2.-.a.5.6.c.d.4.e.e.a.d.a.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.a.s.k.e.t.b.a.l.l. .c.o.u.r.t. .s.h.o.r.t. .v.e.r.s.i.o.n. .3.-.1.8.-.2.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.e.0.-.0.0.0.1.-.0.0.1.6.-.b.d.5.8.-.b.c.1.0.a.b.7.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.8.f.f.1.f.a.3.c.c.e.a.f.a.3.8.b.f.c.d.f.1.3.f.0.2.c.e.f.b.2.0.0.0.0.0.9.0.4.!.0.0.0.0.f.c.3.4.9.d.2.5.c.3.c.9.9.6.b.2.b.6.8.c.d.6.e.5.a.a.5.7.1.c.f.f.c.d.f.6.8.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_59f87023-7e98-46fa-b9bf-9fd68f1f11fb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.879172994559739
Encrypted:	false
SSDEEP:
MD5:	88046D30276A0F319DFAE9A098145F2E
SHA1:	3237521D8FBA4F5D80350F8879F9D5378C11C765
SHA-256:	E7644619AF79058C046BDB104ADB8FF14664F49820631B429BC0EA382FE35E58
SHA-512:	54EC43E03EBA3A1552DB5B41BC963C453097643E56E73290D9A0CC0BFC494267A11F00354316A56ED4F28892CB3C3CB1869ED44E0B87511B489694DF567BAE5D
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.5.9.5.1.1.9.6.7.9.0.2.7.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.5.9.5.1.1.9.8.0.4.9.2.7.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.f.8.7.0.2.3.-.7.e.9.8.-.4.6.f.a.-.b.9.b.f.-.9.f.d.6.8.f.1.f.1.1.f.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.a.0.4.8.8.9.9.-.7.5.7.a.-.4.0.b.9.-.9.8.4.4.-.7.f.a.5.8.0.e.1.d.a.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.a.s.k.e.t.b.a.l.l. .c.o.u.r.t. .s.h.o.r.t. .v.e.r.s.i.o.n. .3.-.1.8.-.2.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.a.c.-.0.0.0.1.-.0.0.1.6.-.a.2.2.7.-.0.3.2.2.a.b.7.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.8.f.f.1.f.a.3.c.c.e.a.f.a.3.8.b.f.c.d.f.1.3.f.0.2.c.e.f.b.2.0.0.0.0.0.9.0.4.!.0.0.0.0.f.c.3.4.9.d.2.5.c.3.c.9.9.6.b.2.b.6.8.c.d.6.e.5.a.a.5.7.1.c.f.f.c.d.f.6.8.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_7c5edfb8-94cc-44c6-b5b8-501c500f21df\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8788956099840357
Encrypted:	false
SSDEEP:
MD5:	3C9ACC5663D3A3E0E6C96CAC0B0382E1
SHA1:	7275A18A7C76FED75CA48B4AD7D4669F40EBBA93
SHA-256:	B8144BC0573146B6E6678B0EEC22D6577AA036765ADDC5E1FFD0936C029A137C
SHA-512:	2135DD2A4CF5969628ED553F06BF994989AB95D211AB1683430FA67E86A4247E7400C2033EA51B9F35656429346FE9CD282A90CE407756857BC19FA59DB39AC6
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.5.9.5.1.1.5.5.9.8.5.3.6.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.5.9.5.1.1.5.7.2.5.8.3.6.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.5.e.d.f.b.8.-.9.4.c.c.-.4.4.c.6.-.b.5.b.8.-.5.0.1.c.5.0.0.f.2.1.d.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.0.d.0.e.7.4.-.b.3.0.b.-.4.e.4.2.-.a.f.1.7.-.0.1.9.2.8.2.9.0.7.b.d.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.a.s.k.e.t.b.a.l.l. .c.o.u.r.t. .s.h.o.r.t. .v.e.r.s.i.o.n. .3.-.1.8.-.2.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.9.0.-.0.0.0.1.-.0.0.1.6.-.3.e.a.e.-.8.0.0.9.a.b.7.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.8.f.f.1.f.a.3.c.c.e.a.f.a.3.8.b.f.c.d.f.1.3.f.0.2.c.e.f.b.2.0.0.0.0.0.9.0.4.!.0.0.0.0.f.c.3.4.9.d.2.5.c.3.c.9.9.6.b.2.b.6.8.c.d.6.e.5.a.a.5.7.1.c.f.f.c.d.f.6.8.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_853fa412-d11e-42b2-a06e-0036eb8cfb88\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8792398851882263
Encrypted:	false
SSDEEP:
MD5:	A63DDE132E2213E7CD55CEDBED172CE2
SHA1:	6C835D8929A904229E9D7FB954426B3BB7FC03D7
SHA-256:	BE29B59208BBC52F697095C40E878FDAAC03A6663FD1EDA36F7AF3CBE2CF8853
SHA-512:	C4E1AB90339D2507D9DD76F923D7389C1819FA05523E07CDA0EE87793C95F1E938133F288701A3338472F063885890790E94EB4894216A5C3DAA312AD36D15F2
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.5.9.5.1.1.8.8.3.1.8.4.6.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.5.9.5.1.1.8.9.5.5.9.4.4.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.3.f.a.4.1.2.-.d.1.1.e.-.4.2.b.2.-.a.0.6.e.-.0.0.3.6.e.b.8.c.f.b.8.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.2.e.e.b.2.2.7.-.d.a.e.4.-.4.2.e.7.-.8.6.1.6.-.5.7.b.9.7.a.9.3.b.6.7.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.a.s.k.e.t.b.a.l.l. .c.o.u.r.t. .s.h.o.r.t. .v.e.r.s.i.o.n. .3.-.1.8.-.2.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.c.0.-.0.0.0.1.-.0.0.1.6.-.1.1.a.f.-.2.6.1.d.a.b.7.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.8.f.f.1.f.a.3.c.c.e.a.f.a.3.8.b.f.c.d.f.1.3.f.0.2.c.e.f.b.2.0.0.0.0.0.9.0.4.!.0.0.0.0.f.c.3.4.9.d.2.5.c.3.c.9.9.6.b.2.b.6.8.c.d.6.e.5.a.a.5.7.1.c.f.f.c.d.f.6.8.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER258B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Mar 26 18:26:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1083288
Entropy (8bit):	0.9947090760175097
Encrypted:	false
SSDEEP:
MD5:	2D3B4A60B25E8C59A5556F3042957AD4
SHA1:	2A7C4D61DBEF6DFA7521B8D274A8969776EED78A
SHA-256:	FEC476CE8D71C558DAD39E2B66D310C90C7F26357E0B066DD109F7DC8E413696
SHA-512:	424F85788EE94B5579A4E902886E45117B769AE0AA8516D30E88B79C60B91658DBE221DE019AE5912DFC25D68A1609E52538BEE9BEC4BB7E21E94A5A8B93E5C9
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......\..f........................\................*..........T.......8...........T................p..........(...........................................................................................eJ..............GenuineIntel............T...........Z..f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29A3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.704178252505124
Encrypted:	false
SSDEEP:
MD5:	F648EC0761E4D79F90E20E06E69871AD
SHA1:	A4E797DC4DF2798C7A21766A3039E942F9570A56
SHA-256:	C23AF88A7F04A5BFB4A34CF62A8780C0E43559AD9E11A0FD3C81F37DE8654AB8
SHA-512:	F7D28E39FCC74D054AAA9B4F33A07A42E72731A2889C9DED012E7298799E8601394EE5E9CD95AA9BAEE158E0602B5B160677A1F4629E16E8368022465D93A119
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29C4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.497222190306022
Encrypted:	false
SSDEEP:
MD5:	9D837B9DF8E9CD9AF40C65D7B22751E7
SHA1:	E2E885208DCEDDA58B53E69A452C20FFFAF88415
SHA-256:	4B697BC511CF5F03E95E754641471928BF419CA8C8F0FA3FC441A39D931A28D2
SHA-512:	DFEA5E5B2D58AB27D2F302CDBBB61A1830E615EA8EC402D1813C1584A95C43A91797E302793217AC6F192CAE09A98CE4EFEB4CBCB0598B934F56B8E8A8F0A914
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="252569" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER457.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Mar 26 18:26:28 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1084100
Entropy (8bit):	0.9132360962942809
Encrypted:	false
SSDEEP:
MD5:	CA5CA3D91168900D43D0BD84B1603C3D
SHA1:	C8B2155E35B6D39D80EE63F81F9B53C7D4BE9398
SHA-256:	B2895E82F2E375CD3E0671DB21AB3BC3D343E5A426D32E017B47071B23F1CA48
SHA-512:	CF67236326A7C3AD1B23AD6AD954F1DC9943646F9470B3BDF03667530B8EE5C12887C615758C3ABA65F50721A09F4F8F847B213D2F76EF91C5710B441A098D25
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......T..f........................\................*..........T.......8...........T................t..........(...........................................................................................eJ..............GenuineIntel............T...........R..f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER862F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Mar 26 18:25:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1087196
Entropy (8bit):	0.936262157184961
Encrypted:	false
SSDEEP:
MD5:	FF37183FB658F5E3DA73AF35A6722398
SHA1:	24E7867B15DDA51C86005F1E4320FBB5EFF99A3C
SHA-256:	A99A8AD7BACF7AB3B7736C8D10417F6F962E83D8D4E13BD332DB6337AFE1A9C0
SHA-512:	910F3EE590C1C622100BB2EED1292AC7E8F721A720C0DD75044590EBA8D73F00004457E48C88A58EE1B7FBCECEA4B6CF7EBD789C7EEB283759D62F54DFFD14D6
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......4..f........................\................*..........T.......8...........T...............$...........(...........................................................................................eJ..............GenuineIntel............T...........1..f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.700178453877851
Encrypted:	false
SSDEEP:
MD5:	4D91745072D20C68F05E0B1A7A872F92
SHA1:	0C39846A84E69AD133680B5C8455981AA2FAAB61
SHA-256:	00C5FD32856977C2342941706089EEACB8023BB4BC92E0218D468971489453A3
SHA-512:	BF82A9FDBD87B7F2F027A95444E6E82A0BD5DA0450A05FE6419C34EE1E8C587EE06C2C2699D127C8D8D4FDFA1F416B7126086777F4645A7DAA7FA0AE0BB09630
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER89F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.499100600534943
Encrypted:	false
SSDEEP:
MD5:	3EF143394D508E128D82B6942A7DB2CC
SHA1:	9ECA3F764ADC256D251685078F8F53A0D674066E
SHA-256:	039C51189FDBE1B6ED9B2A2001EEB58D5D08CCA469A58D0301C8356586EE2F1C
SHA-512:	B12D783EDA936A0632719AF5BADC2406CB0322785CD3521612E1A72C3AB4805EB91D98A7CEA016A1518DB512A9D5A74B3C395C86194D7C40F64246224A857CFE
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="252569" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A50.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Mar 26 18:27:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1085624
Entropy (8bit):	0.9459608808112366
Encrypted:	false
SSDEEP:
MD5:	6C3C1D442711484DFEDAF0EA6937D6C0
SHA1:	E81E63A2492BD1B4EE9953BC12E5BD789EF25614
SHA-256:	BA50398031DAF73601BD811AB5326B571348ACE78CA565989D84A1ADF7B94637
SHA-512:	F55ABD3C4189AA5AD392A8B4423294781EA7090FD50173AFE7B5928D26EDDC8BA0289F62DEC202A3E65A11A4A5219C873CAA8EE16ED90656C9850219F6A5DE0C
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......v..f........................\...........$....*..........T.......8...........T...........@...xz..........(...........................................................................................eJ..............GenuineIntel............T.......h...u..f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A66.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.7029970523887688
Encrypted:	false
SSDEEP:
MD5:	F6FEE98EB9E3F93B32DCFA548676D02E
SHA1:	1B61894CDADA385BCBACBEF0701A81122172D517
SHA-256:	D67E6F94818E08449AD6A1811F14F47B3841BD18A00CB50B391AD868509E6288
SHA-512:	3692331CEC9342EEC9F7F2B01EB9B4455FD8444F72B9940316FB6075ECBBC2688857492AFFEA4DD41F84FCE258ED349FBE7AA2417D285AB5E7D6C4E28980C34C
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A86.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.497583547418009
Encrypted:	false
SSDEEP:
MD5:	8C1E8F275E01C1841DA8EA45084F4B61
SHA1:	D12688433131CD765385226DF9C89D5C7B5AD780
SHA-256:	D083652231918299ADA12221085E611DE9382C0F29745E63FDA43020FB643931
SHA-512:	B16D0C6C8D032FB60491266A59C966CB760E302F7FCD65D8CCC6A94897F0F6965717253BE0B092E893999587D3B80D434BA4E8363AD833738081BECF2655BCE2
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="252568" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E49.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.702362557177982
Encrypted:	false
SSDEEP:
MD5:	DA1C98737FB0D30DA8D331116F0E5A79
SHA1:	896E704D1F69EFAD1392E4C9D4BB078A886B89F8
SHA-256:	AEAD9494912BD014906E96171DACA09884D3DB3895B371B18ADC3E364F43B870
SHA-512:	68A8091507F221A46EEF56D2726597511647725A9B010C90312FDA4E8C2213AF76A6885857594AD31339DA6CCBA7689D8E8509716A06877E976650DD01A0EB94
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E69.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.4998879916239565
Encrypted:	false
SSDEEP:
MD5:	71686247FA782E01DC100D1726DBB9F9
SHA1:	3DFC89FE404538A72D234372CE34E1CC7F499A45
SHA-256:	5B84C9D6A22E28CF29D160B191DF9BA588F759857AC794663B4206CFA33CB952
SHA-512:	ED9E98900F8F2BFA55DE7268F16B641D703F263F6D748F9615550A5D2BDF2D4A133FE586803C3EB094C268F27AD811C8C0E4FDB4DC0387836ECFC8CE5D8C09AD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="252569" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2FB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Mar 26 18:26:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1082668
Entropy (8bit):	0.9084787012307924
Encrypted:	false
SSDEEP:
MD5:	9A7CDD2B873C3E6FED4A1C9FF62BAACF
SHA1:	D0D296D14C655BA85C2C074AB765BDA429DA5E58
SHA-256:	05263CB0518E61805A53CE6898B14BEC28AEB15DF56F27868DCA4DB1A08A7A4F
SHA-512:	A36C625C42441E9007483A919E9650920AFD5AF68B6274C07B373ABE3F4F8ACF819D7DE286FC9A04AD0318748F7FAEB596A8FE163B5A6F98D3FA82B75D902BC8
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......?..f........................\................*..........T.......8...........T...........@....n..........(...........................................................................................eJ..............GenuineIntel............T...........=..f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB713.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.700524496254837
Encrypted:	false
SSDEEP:
MD5:	AF625BB0A428EE4A7A5D70E061ED9E11
SHA1:	4172B69CDCC25DA92CF663087D843EAFD24AA8F2
SHA-256:	6D84EF14D66B2EFABA9123D1591FE9032CF1B860813A0C90D625A9A01775CF20
SHA-512:	67558ECB7900933BDA32C03A5F6F45D59BE1D3BD4E05FA204E0185CB9DF89A4DA6ED594DB0AABAAC40EF4026128E4213B165B0CAD793B50AD6338DFA24499234
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.1.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB733.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.496858198327303
Encrypted:	false
SSDEEP:
MD5:	481C402481FD2499EF5C7B52ABDCA7BA
SHA1:	4A42CC7A2AD751084E080AFF66F1322A2A44A9A1
SHA-256:	EDCA3A0A6A848FC52EBB871705253307293E9B6297EB534CBFFE25A8D691037D
SHA-512:	1C77E88B6916E39B908975A41973F4F9D2BB6BFB41EF49D4F83649D167C7A7940F921B3CE2B0FC0908EB90AA75EF9014C5EE81BE45899DA205A344A552818420
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="252568" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:25:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.988655130338227
Encrypted:	false
SSDEEP:
MD5:	0EDCBF8BF82F5F022CA9BE99049C19E7
SHA1:	0DEAA237883A30996C765535F0B6CE94C9AB4843
SHA-256:	132F993507CD7CD660389CC25E014ED4B1405F45000F4A1237F6290812B3A94C
SHA-512:	67BCEF347C18E91AF05FFE24B95A64C2F7606F1AB5F2F043A7CC8C3C8E4C97F550B48CCDF8F3985D63B6D517A34CB14D5C2FD81183D1077A81BF918B7934D7F7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......G....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzX......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzX$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzX$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzX$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzX%............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:25:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.006725744882334
Encrypted:	false
SSDEEP:
MD5:	29689FF53D5AEA4998E98BE0B957C1E4
SHA1:	5CDD825036F7FA9C58481DCF7AC0490ACC1CCEC5
SHA-256:	68C3A26226794E8D475B23C345BD4BCF662B7F7DFC8D177428E9298E4FA5D160
SHA-512:	EF7CB0D4628A8811446D77C630B443364BCEA6BCDA35744DEA9CC7FEE85BB955F0B0E2F2D34620255C0849F24795BB181E549811B89882D94970686CDBFC1636
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....."<....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzX......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzX$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzX$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzX$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzX%............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.012092395106208
Encrypted:	false
SSDEEP:
MD5:	86F9825D9075919DAA7A5D21D1F80D34
SHA1:	6C8350200776BA79CC32018777F512A3E9879026
SHA-256:	A0519B5FCB0F7BBBB16C4488471AD9019D676B3FF58708A94C540B0DBFE3DFB3
SHA-512:	CE1724AD98063B7F386FFD0ACE0964F04CE009C47F774ECB8D478E602EB30FFC5D9C004A221ABF022FDF5A8D460EBD78D02ECC41562679825A3C9DCB64FC4313
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzX......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzX$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzX$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzX$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:25:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.004706704222525
Encrypted:	false
SSDEEP:
MD5:	E02D39D635FE6A4A7A16FD767BFC2F2E
SHA1:	AABF3822FE75B4FDCD202F16FCCFF4C663FC54B8
SHA-256:	894879E645DE7008217657D055893BFB0EA95C813A7DEDC890FB36D57E357A5A
SHA-512:	A0651C8652960E7055780DF08F62A810F623AEE6D0797827837BD02ADA86EBC0CB260655110938ECB1D37021E694863CE48AAEB2C162DF7A7E23D02A650DC402
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......2....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzX......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzX$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzX$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzX$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzX%............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:25:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.991067538636077
Encrypted:	false
SSDEEP:
MD5:	01BB201EC3BA12EDEF67B36DDDCEBFFA
SHA1:	BD72A594BA244CCCFD5538FB79CC60AD448DC104
SHA-256:	9B4F80389FD42819517423A66D29B02F549FE667904F030C6AD72811D2D48898
SHA-512:	A2673B8CA31C9D64B08989DFE637DED1A83412A2FFFB11A675D4EB2849CCDC949F9ED0E05805B9A8C85FB860096169E2A51399EF9C7661FA753A3B2A71AA9B72
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,...._.B....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzX......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzX$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzX$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzX$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzX%............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Mar 26 17:25:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.003617444218905
Encrypted:	false
SSDEEP:
MD5:	AD22F089F4057BF0535FBAF2C8C824F8
SHA1:	DBC16CF868A4FB774392259A6DB622ADFD5C5494
SHA-256:	4BE6B012BD113AFF99EBAED6D473DF5A054AA6578C410397D79BEBA9C46CE6E9
SHA-512:	A53B7064025108F533510B356583D1AA431DC1EF10A7937B8CEA50E1CAA2315A4492D8D3A58919E68B346463FF943F1B1A2F9701D84100A136E88B651E3DC9A0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......(....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzX......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzX$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzX$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzX$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzX%............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............Y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\Basketball court short version 3-18-24.exe (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	14B4281E33D39A0A1C20A46608D7D5C4
SHA1:	34E408BAF0FE8DFE6E4D298922FB16F8EA81A555
SHA-256:	6BEE5EA2C1A7E828B045A2BC249C9BE9B0B2EDCDF5BE037BC938B1AEA77AEFF1
SHA-512:	A6F45EC29E9A0E3B1A37184332D0D88C88B1B85060C4297B28382E6CCCF2BF76BC49B7977C2631E530FBCC85620CAB07F882D2BB5A6BFE09CEA42C3C50493EC8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........t.H..\|...\|...\|.K.....\|.K...4.\|.K.....\|.....6.\|...\|.\|.\|...#...\|.a.....\|..K....\|..Kx...\|.hKt...\|..c....\|..Ky...\|.......\|."....\|."....\|."....\|...}.,.\|.hKx.i.\|.hKy.0.\|.hK\|...\|.mK....\|.......\|.hK~...\|.Rich..\|.........PE..L......\.....................@........... ........@..........................@............@..........................R..db...1...........1...................5..........................................\...................dQ..`...................UPX0....................................UPX1......... ......................@....rsrc....@.......6..................@......................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\Downloads\Unconfirmed 75163.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	212078014
Entropy (8bit):	7.999605447813714
Encrypted:	true
SSDEEP:
MD5:	14B4281E33D39A0A1C20A46608D7D5C4
SHA1:	34E408BAF0FE8DFE6E4D298922FB16F8EA81A555
SHA-256:	6BEE5EA2C1A7E828B045A2BC249C9BE9B0B2EDCDF5BE037BC938B1AEA77AEFF1
SHA-512:	A6F45EC29E9A0E3B1A37184332D0D88C88B1B85060C4297B28382E6CCCF2BF76BC49B7977C2631E530FBCC85620CAB07F882D2BB5A6BFE09CEA42C3C50493EC8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........t.H..\|...\|...\|.K.....\|.K...4.\|.K.....\|.....6.\|...\|.\|.\|...#...\|.a.....\|..K....\|..Kx...\|.hKt...\|..c....\|..Ky...\|.......\|."....\|."....\|."....\|...}.,.\|.hKx.i.\|.hKy.0.\|.hK\|...\|.mK....\|.......\|.hK~...\|.Rich..\|.........PE..L......\.....................@........... ........@..........................@............@..........................R..db...1...........1...................5..........................................\...................dQ..`...................UPX0....................................UPX1......... ......................@....rsrc....@.......6..................@......................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.310250167845228
Encrypted:	false
SSDEEP:
MD5:	E8A55CB56D43D69C51CF6AB3A5BFCF28
SHA1:	C5BF12D5B20C6BB5CA74C3D08780022DB724A019
SHA-256:	65B77359F1C2EF1ABACA1C7AA8D46ED01CF2B538AE9A53DD573BEC434979EE64
SHA-512:	B88C1355E1EE9F3784B872BAF752050A813CB2F292FD8EA7A26BCBE735575C86779C305B83EBD1B1F4E1565638C92643106E660C0124ABD950D1C3E84A1F4CDD
Malicious:	false
Reputation:	unknown
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.0.....................................................................................................................................................................................................................................................................................................................................................%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.5774484752295255
Encrypted:	false
SSDEEP:
MD5:	34152A31F8BECE07BE5AF10A208F3F6C
SHA1:	C9DEDB754F1D20331D296E0C88C668C06456DEEF
SHA-256:	A219235C56373F521446B576E0A29C7890423C26B26D4F402E52DD59694E5748
SHA-512:	56F77581DC2B681749FC94B49A833B6EB7A060BB0DFBE24BABD7465DC482CEAC2E3D19274271E94EE3AC83D321B46874D60FE599127B6B7E1493AA913FA82C1E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....6IDAT8.}.MOSA...33..h.....5.Di...0&...$&&......Ntm...pKM.%n..v$.h.$&....;w..PZ...$.y.w....d.0.I..A..v...ae+.}..sw.Q/....._Raz(......}.......(Zx...:a0U,VL`..k....@.Cb...H..:...l..j--..I.j....k..t?....d.P..l;3.G..5..l..^6......o~\|..u. .Y....d.....O...?p..%..u...,..+.M.H}..a0.@..........ke.@i..I....*7._h..w..uE.......ZI....R$.5..G.C5&.(.r..g..JQK.b....c.T"......t.8..y.....ARJ..^...7....."..~._...\|..;.P.......(!).....r... pQ....v.(..i.E..1..CFi:.]..,.2...T5N.R...C...(.p.D..`m<?..5\|..\.1..&..e....9k.. .QZ#..SZ..!q\[8l.........-......v....j....5...E<.....IEND.B`.

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	382
Entropy (8bit):	5.36072025921595
Encrypted:	false
SSDEEP:
MD5:	3064B4F2FF8937A7B3973EDCE0E23816
SHA1:	9E83BEE774932F40C1134D489600D61BF701C982
SHA-256:	9BF6AF8198DC1C13049D8745E2E0C975FA8EA21369D13C475BAD51DD011D59B8
SHA-512:	16F4F5A1FB838C9451B7810CB0907E8F12033EA32F1FDEE38329356406E91B43DBB253A55070C3A70DF74C10C66245B31061B6C5D885D5D75D91F83DF99CE4B9
Malicious:	false
Reputation:	unknown
URL:	https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.uvrmm4sgViM.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo_AfeXEgP9UD-iQrKiwqZLadQ_cBg%2Fm%3D__features__
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<script nonce="KzXMDVoAlO8igK_IlP1lBQ">. window['startup'] = function() {. googleapis.server.init();. };.</script>.<script src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async defer nonce="KzXMDVoAlO8igK_IlP1lBQ"></script>.</head>.<body>.</body>.</html>.

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	184
Entropy (8bit):	5.1934451077591985
Encrypted:	false
SSDEEP:
MD5:	C88DA29BD0CCF37FCA7ECE6E94BC3698
SHA1:	0B2F5EC9B805BEBE5610E0E8518E40F68F3E99B3
SHA-256:	27584D0B6C21B8E1ECAC18D4CA060094F0877AF857EAB8927DC99379F053035F
SHA-512:	E02F49D225693D1EF45276E599B605C5294E3710688C84FCECA2664F16360503BDADA0DAC02C2B478BF2579740DA551FBE604ADBC8CAD92F15D5EF1FE247ABF4
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.7zJe3fq_zWU.O/am=gAE/d=0/rs=AO0039uv9ObcXgz9YyUk0XXtSXAwkFfwvQ/m=jhxjge,ZdZQ6b"
Preview:	try{.w("jhxjge");.var ZHd=function(a,b){AG.call(this,a,b)};P(ZHd,AG);mh(oPa,ZHd);.x();.}catch(e){_DumpException(e)}.try{.w("ZdZQ6b");..x();.}catch(e){_DumpException(e)}.// Google Inc..

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2628)
Category:	downloaded
Size (bytes):	78816
Entropy (8bit):	5.595039197853547
Encrypted:	false
SSDEEP:
MD5:	C33274557C7019372DAF65D62BEDE0D4
SHA1:	D4642405EFDCE1344E98D6890113A1CDF92760A3
SHA-256:	748653B2A83FB6E79F7CF4217DE88626DE140EB70A06AE1A7EFD295A510AB339
SHA-512:	132EC32AE9BBE815BFB26E787ACD00676003406FE40BB50D6D972573C72388ED677FCF5DEA0809D33DBE9B712F4685FBCFB89E5DB8D01C1BDE31397054C09136
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uvrmm4sgViM.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_AfeXEgP9UD-iQrKiwqZLadQ_cBg/cb=gapi.loaded_0?le=scs
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var da,ma,na,sa,ta,ya,Ca,Ea;_.ca=function(a){return function(){return _.ba[a].apply(this,arguments)}};_.ba=[];da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ma="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.na=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.qa=na(this);sa=function(a,b){if(b)a:{var c=_.qa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=bcbbcoavbd35
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	118370
Entropy (8bit):	5.846748398907928
Encrypted:	false
SSDEEP:
MD5:	BA7AB7044D6C6C0240C3917858948CFF
SHA1:	3B840B104CB3D74D5A35FBD193ACA32D27815D3E
SHA-256:	0189F7C6ED35A7BE5E51A30366FBC54C9C9E27D2511DB44895D85A1458F83AB5
SHA-512:	660D3407052C6965E6451C8D2AA9DC302C0F97129864E320731B89174F2A87B776201A57AA30A8CCF1A455700A6D9E2C42A070CC0F964D14A6D9E73DA47C4697
Malicious:	false
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="31px" height="3980px" viewBox="0 0 31 3980" preserveAspectRatio="none"><g transform="translate(0,960)"><path d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,432)"><path fill="#C4C7C5" d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,2152)"><path d="M17.705 10.1401L14.3 4H9.70001L3.60001 15L5.70001 19H13.8027C14.2671 19.8028 14.9121 20.488 15.6822 21H5.70001C5.00001 21 4.30001 20.6 3.90001 19.9L1.80001 15.9C1.50001 15.3 1.50001 14.6 1.80001 14L8.00001 3C8.30001 2.4 9.00001 2 9.70001 2H14.3C15 2 15.7 2.4 16.1 3L20.0307 10.0882C19.6959 10.0

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2054)
Category:	downloaded
Size (bytes):	15118
Entropy (8bit):	5.466749905796788
Encrypted:	false
SSDEEP:
MD5:	BA46414875BF2144AE0B87EA416B343E
SHA1:	D9DF053E9F36C823779F1D998EF9418F43E8F442
SHA-256:	C1EF85631D3600F9983D8C582AA5704FEA9140C2A183B6BA1FB35D5E954EA047
SHA-512:	3CAD633A1A970A3283E7421B67BF5C5D88E446832F5138F5108D178A12ECFA49540B6FC6B0FAC311772AE280E46ECBE1156006517CCD2316308B5AD6B40CB1A5
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/js/googleapis.proxy.js?onload=startup
Preview:	(function(){var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(null==a)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	2664715
Entropy (8bit):	5.696179385482323
Encrypted:	false
SSDEEP:
MD5:	BC7BE7B9CC976E1A5F56E039C3F5A1F6
SHA1:	A55B2452FC09F13005CBFD1CCEBD4858A1D88E84
SHA-256:	897E4FF5AE908AAC6BB8DB5A21CEB457E5004C3CF9618F62BB10BE94F23B2E30
SHA-512:	EC54C41CB9F4E114E9A6D253A21F73B9F9DA9C57F2512708E544411D327C0DBAF474E667F45437BC947FA5EADE56E76CDEEA100D58665DCA2BD0DFB63A82F982
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/_/apps-fileview/_/ss/k=apps-fileview.v.PUDHNxPQoaY.L.W.O/am=gAE/d=0/rs=AO0039soCfvarX9hb7EV9AiEuKFVxR7hkg
Preview:	@keyframes shimmer{0%{background-position:100% 50%}to{background-position:0 50%}}@keyframes fadeInAnimation{0%{opacity:0}to{opacity:1}}.ja0jmf{-webkit-align-content:center;align-content:center;-webkit-animation-fill-mode:forwards;animation-fill-mode:forwards;-webkit-animation-iteration-count:1;animation-iteration-count:1;-webkit-animation:fadeInAnimation ease 200ms;animation:fadeInAnimation ease 200ms;background-color:var(--dt-surface,#fff);display:-webkit-box;display:-webkit-flex;display:flex;-webkit-flex-direction:column;flex-direction:column;height:100%;position:absolute;top:0;width:100%;z-index:3000}.F6wkof{-webkit-animation:shimmer 2.2s ease infinite;animation:shimmer 2.2s ease infinite;background:0 0/300% 300% linear-gradient(-61deg,var(--dt-inverse-on-surface,#dadce0) 40%,var(--dt-surface-container-highest,#f1f3f4) 50%,var(--dt-inverse-on-surface,#dadce0) 60%);background-color:var(--dt-inverse-on-surface,#dadce0)}@media (forced-colors:active){.F6wkof{border:1px solid var(--dt-ou

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1759
Entropy (8bit):	4.410540924225597
Encrypted:	false
SSDEEP:
MD5:	7557E041F983104811EE0C7500267EE2
SHA1:	B138CF6E2DB20A338EEF60175921F06D29A6F144
SHA-256:	C22F45EA44183F703993017BAADF6CFDCB2A4E1D0FE80227BDA4E54DC0697C6D
SHA-512:	31191DC8FE1ABC738A8B907D89021F8643922C82EB30D5261AE2B202DD345EB7D531EFC22986EE6E2D2CE83DB2F46A198C44F49C6FA496FCD8EDBA0BAA3ACDB6
Malicious:	false
Reputation:	unknown
URL:	https://blobcomments-pa.clients6.google.com/v1/metadata?docId=1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC&revisionId=0Bw5nuwl_bcFeUlpvRU1mMlBudTVmYmFGa0xVVUVJSjVQajAwPQ&userLocale=en&timeZoneId=Etc%2FGMT-1&documentResourceKey.resourceKey&forceImportEnabled=true&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{. "serializedDocosKeyData": "[null,null,0,null,null,null,null,1,[\"Anonymous\",null,\"//ssl.gstatic.com/docs/common/blue_silhouette96-0.png\",\"ANONYMOUS_105250506097979753968\",1,null,1,null,1],1,\"AAHRpnXsamo7-6WXqbSohx_TEi9WhjVRvbFtBO1eKsynClWiMrB2WtLwL9oQDAL9i8mO1s6-DCC99Q_ILW3RT3C2vVFcFblLx1Q\",null,null,null,null,null,1,null,null,1,null,null,null,null,1,0,null,null,null,0,null,null,0,null,null,null,null,1,0,null,null,null,null,[\"tf\",60000,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,1,null,null,null,null,null,null,0,null,null,\"\",null,0,null,null,null,null,0],[[5703839,5704623,5704745,5707899,5711538,5712270,5712639,5712647,5713195,5714051,5737800,5748810,5771837,5771857,5779500,5792878,48966262,49372463,49375342,49451659,49453005,49472091,49622751,4962314

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	7.862952554761723
Encrypted:	false
SSDEEP:
MD5:	C66F20F2E39EB2F6A0A4CDBE0D955E5F
SHA1:	575EF086CE461E0EF83662E3ACB3C1A789EBB0A8
SHA-256:	2AB9CD0FFDDDF7BF060620AE328FE626BFA2C004739ADEDB74EC894FAF9BEE31
SHA-512:	B9C44A2113FB078D83E968DC0AF2E78995BB6DD4CA25ABFF31E9AB180849C5DE3036B69931CCA295AC64155D5B168B634E35B7699F3FE65D4A30E9058A2639BD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX.WkLSg.....65..A-f....lOk..."2..f[T...9.3q.q.....CnaKX.4.A/\D.l....m1qY....~ik+..F.i..;.A..,.<.NN......~..B..1.f..V....7....?.R..<.r3./...d.....A..h....S.......W^...`...0.......?_M...L.....`M.V.muG.$.e.J+.~Y........B.g?aF.+..M1..[.1. .?2O ...n.y.......XuQ.H. ...A.....+.....b..D..D.y......E.....M o4....R.w..b;`...R..#.\.t.%..]..[....%X<.L.Eo5Umm?..F.Oa1...W`uU:..L<..k..C....7a..1../QD3..U.D.l.T.5H......4...v......=t.."D?b.Pr.~....d#.Q.R.......)9'F/B. ....U.k'...p.!..J...O4.J.)G./"9.6.)@....4.h.(B2I.fB...AD.........7eK.%.O$gP.v.... y.t"9.E...h[...z{.C..[....7.......4......-....X......tJ...a.y....o<P..."..H\MI(Y....Y..A.,.D.$6B..`.Y..B......y..q.m..ci..,F.w......^h&.t...Y.]/......H...d<..cl.c...6N4..8FI....h%.[&u....cd.L.\|...M......."n...&.....d.'t:...c5..{~/7E.(`.`...>V7.RXS.k%..9...l....eRm...%..i...~.@.B..?.".../.v.0.@.c{.(.^w.=....:t=.>........V..}P..`...}.!u..k...p.ye...6.'..,.....Y..........

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (597)
Category:	downloaded
Size (bytes):	1675343
Entropy (8bit):	5.618125716654133
Encrypted:	false
SSDEEP:
MD5:	9AE5BDE60353C1537EF40E7B43CB7FC5
SHA1:	DA246108976986E6EA0205412D9A4EFB3B2C0FFF
SHA-256:	E98DB9B5E27F85353024AF2A70EF366B009A71298F7AD5D6CAB80EF8A1BC5E00
SHA-512:	8B7D7D8E6C958D1AFBD51F499F14DE03B97B31DF3C1E4DC7BBC2EADDD5B9352FA5CC0917F65299CB78E72DEF63DFC9D7E0F158BBA7C9E07EF3379BC0ED18D263
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.7zJe3fq_zWU.O/am=gAE/d=1/rs=AO0039uv9ObcXgz9YyUk0XXtSXAwkFfwvQ/m=v,wb"
Preview:	try{.var _F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};_F_toggles_initialize([0x180, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././... Copyright (c) 2015-2018 Google, Inc., Netflix, Inc., Microsoft Corp. and contributors. Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.././*. Copyright The Closure Library Authors.. SPDX-License-Identifier: A

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	21836
Entropy (8bit):	5.612275151948576
Encrypted:	false
SSDEEP:
MD5:	087964E8AC859B87529454C53FAE4F73
SHA1:	FFD324F4787D9D80265071B14D0EEA980327555E
SHA-256:	8E20748D4F2809DE43DDEC5EBA1D8CBAC192079F996FC4FE88DD3A5C159D31E3
SHA-512:	FE5461898F46415A540012BACB2060EF7A20AF0B5504195AACEB009BCF25FC9B6C76E50BA24361B9EFD5AA54EEE9126CECEDC33D0502127052818CCE5691E873
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Google+Sans:300,400,500,700"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2122)
Category:	downloaded
Size (bytes):	218116
Entropy (8bit):	5.520938530269999
Encrypted:	false
SSDEEP:
MD5:	6C551C9378F09BA729327D85A1DA057D
SHA1:	E9A8F9B70E684C37278CB6B0D7648865CC751BF4
SHA-256:	C94E3247AF806C832C6CC47719D99B88B942DCC22D2B055E7CFF524BCDE76B9B
SHA-512:	54536DF68608FFB6308852ACF14CFD27152DD8DF81D216B32F27BA38C221C8F3500B77D4C9B8D542AAA07243FC496929419DA71A70C3CC703ED837908AD89ACB
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.dogDKQInKz0.2019.O/rt=j/m=qabr,q_dnp,qapid,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTsw5QIWBz13IsEaqvclOTrY3nEiuQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.se=function(a){return _.pd(a)&&1==a.nodeType};_.te=function(a,b){if("textContent"in a)a.textContent=b;else if(3==a.nodeType)a.data=String(b);else if(a.firstChild&&3==a.firstChild.nodeType){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.qe(a),a.appendChild(_.re(a).createTextNode(String(b)))};var ue;_.ve=function(a,b){b?a.setAttribute("role",b):a.removeAttribute("role")};_.we=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));var d="aria-"+b;""===c\|\|void 0==c?(ue\|\|(ue={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=ue,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var Ae;_.ze=function(a,b,c,d,e,f){if(_.Lb&&e)return _.xe(a);if(e&&!d)return!1;if(!_.Jb){"number"===typeof

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	7.690596689293278
Encrypted:	false
SSDEEP:
MD5:	916C9BCCCF19525AD9D3CD1514008746
SHA1:	9CCCE6978D2417927B5150FFAAC22F907FF27B6E
SHA-256:	358E814139D3ED8469B36935A071BE6696CCAD7DD9BDBFDB80C052B068AE2A50
SHA-512:	B73C1A81997ABE12DBA4AE1FA38F070079448C3798E7161C9262CCBA6EE6A91E8A243F0E4888C8AEF33CE1CF83818FC44C85AE454A522A079D08121CD8628D00
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/images/branding/product/1x/drive_2020q4_32dp.png
Preview:	.PNG........IHDR... ... .....szz.....IDATx.b .....+......m..dW.@..tm.Y.....m.....m.m..L.\|.....{..b...t..........=H..qt..V..X..<jQc...p...fdU.\2.....9T...Jz!9...L.)&.....n....`~.T.\.\.$.....qQ.....LFOx......^&,"bB..Lh9$_.6<...A...Q.T&y.,'...p...W`.2.?X(.o.4.J?.2...@.4.....X..c......[UZJ...MN.].z..f..DFe.J.....:!r...0X......).....^..!....u..c..R4.GH....Y....E....Q......+!..)...e"......,.Ge.r.T..!..r..(.\|.9f...}......(...s..N...[..~.%6QF..g..r......CN.e"(..uY.h._1.H.e....r.k..%^S.c..<..0.s.j..,D........]..y.2(..OC.o\.3..".....cw...:;.btq......w=.......R-[].4..]...?.....o..K../cC.<O...y..O.......{.-'Ln9..M.*6t.(.........o.K.$....bz.X._d......Z].U.....t....Bf.Zl.^vA._..g.{l....V...{....=.jua..[...k......j....Y\...!..+.m..X..t(....."..Mz.26l....7X.C...-...Z.lvl.......y}x..........7.m.VV....IEND.B`.

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1290)
Category:	downloaded
Size (bytes):	205284
Entropy (8bit):	5.523631436576388
Encrypted:	false
SSDEEP:
MD5:	7A52489AB93FBF1D5C48445C1F8B0B22
SHA1:	6DF2534DF34CF88E1EC5ECB3DBB854F5A3772604
SHA-256:	F2FD87CE7683C9952FC050FC173F5E0929F0C38B3FD4DF6C5F030FACA6680D24
SHA-512:	7F287273FB3D66D7C33330DD16C2FF7F7B811788C2F1F9F0282576E4212F71E4346A3F640D329A30A57C433AE4C9B090C10E655A134B373C47BDD4B73E14B836
Malicious:	false
Reputation:	unknown
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uvrmm4sgViM.O/m=client/exm=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_AfeXEgP9UD-iQrKiwqZLadQ_cBg/cb=gapi.loaded_1"
Preview:	gapi.loaded_1(function(_){var window=this;._.rh=(window.gapi\|\|{}).load;._.Eo=_.hf(_.tf,"rw",_.jf());.var Fo=function(a,b){(a=_.Eo[a])&&a.state<b&&(a.state=b)};var Go=function(a){a=(a=_.Eo[a])?a.oid:void 0;if(a){var b=_.ef.getElementById(a);b&&b.parentNode.removeChild(b);delete _.Eo[a];Go(a)}};_.Ho=function(a){a=a.container;"string"===typeof a&&(a=document.getElementById(a));return a};_.Io=function(a){var b=a.clientWidth;return"position:absolute;top:-10000px;width:"+(b?b+"px":a.style.width\|\|"300px")+";margin:0px;border-style:none;"};._.Jo=function(a,b){var c={},d=a.Gc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e\|\|(e=d.width\|\|a.width);f\|\|(f=d.height\|\|a.height);d.width=c.width=e;d.height=c.height=f;d=a.getIframeEl();e=a.getId();Fo(e,2);a:{e=a.getSiteEl();c=c\|\|{};if(_.tf.oa){var k=d.id;if(k){f=(f=_.Eo[k])?f.state:void 0;if(1===f\|\|4===f)break a;Go(k)}}(f=e.nextSibling)&&f.dataset&&f.dataset.gapistub&&(e.parentNode.removeChild(f),e.style.cssText="");f=c.width;h=

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	1021
Entropy (8bit):	7.590634714710482
Encrypted:	false
SSDEEP:
MD5:	78071F5BA7EF98D8340767AB26BD8793
SHA1:	30CE0D1A75A853CC717AAE17FE4B7CB484BE8F68
SHA-256:	1E5DFEA3C2B1E1CE9250D9F816554C2A896CF1CCFACC2A68D8B7BDE102939B0C
SHA-512:	278C0D93EB56011EF382CE0525FAC98484792E387932B9271436CCA4A135D81DF2805AA8FEDE929E75B06F56334DE48DFBE5AE8BCA279A53F92C65A37311434E
Malicious:	false
Reputation:	unknown
URL:	https://lh3.googleusercontent.com/a/ACg8ocL_t8ocAWYZy2pHumB0P33YE2HRD2nQS7aBF_YfHkES=s64
Preview:	.PNG........IHDR...@...@.....%......sBIT.....O.....bKGD......q@e..._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....8IDATh..KL.A....}.ii.m..E.1...H. .4.T../....j.p.CL..zP/.....A.b\|D#"hb..7" ..h..h)[...$`..f ..i.\|...:.}.m..W...iO Y..m..m..m..m..m..m..m..m..m.._y.xV.6.4.c(..i...y.#..w.._V....6..4....A...g.X..(.N]\|.V.%<.b[..f}.......T^b.VAUS..Od.......E\|l.$V....7.V.@@.?0#..l)E..H...&..`\|z6....N@.....".4<wa.e....Ti...R......5...J....e........mckG.u... ...g[)....R..::...P.(@....\.D.....d.i....r......R.."......7....(.....j...A.`tj.b.P.A.\|j..B.......5W...;:.d.{...^.<d.X.......-.,......1.&... +p........5.......V...p.L....0h.....f.K....1...\|.v....v..w.{n..]v!.$...mv...p(Z.4,....tIv"w....o.x..^.W.._.'v..mo.l:(.D..K...[S...B~..`F...4J<.y...=... .-w.U..:....3..o=...d.e ..........sA....n....b..a....F.Z<J.RD..7...0.A-..7..J$.r?.<.Zx....+P..J..4....ux....B....F..~y.......c..............................

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (875)
Category:	downloaded
Size (bytes):	7641
Entropy (8bit):	5.585043181399097
Encrypted:	false
SSDEEP:
MD5:	2BDCFEC576CEE02E56528C153C4D0063
SHA1:	B3C1312C97FDB95A954AE2C3ADFD1757509195F1
SHA-256:	D6893FE7CA5583AF13988E6BE3F8ECEC6C4ECA547758BF795C04B23638152335
SHA-512:	F954D14871741974E669455F59DAC8DE8594AAA609B0C2EE3A8CC78C4552A71FB700DDDCCF5B70C05FFD7328788E60EC5F20A710911BC6B81E64C3E313098115
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.7zJe3fq_zWU.O/am=gAE/d=0/rs=AO0039uv9ObcXgz9YyUk0XXtSXAwkFfwvQ/m=MpJwZc,UUJqVe,sy3,s39S4,syl,pw70Gc"
Preview:	try{.w("MpJwZc");..x();.}catch(e){_DumpException(e)}.try{.w("UUJqVe");..x();.}catch(e){_DumpException(e)}.try{.Lf(Vt);.}catch(e){_DumpException(e)}.try{.w("s39S4");.var mOb=function(a,b,c){c?a.setAttribute(b,c):a.removeAttribute(b);a.hasAttribute("c-wiz")\|\|(b=a,"C-DATA"===a.tagName&&(b=a.parentElement),CHa(b,!1))},nOb=function(a,b,c){var d=a.getAttribute(b)\|\|"";c=String(c\|\|"");c=c.split(";").filter(function(e){return e});d=d.split(";").filter(function(e){return Ah(e,":.CLIENT")});Ma(c,d);(c=c.join(";"))?a.setAttribute(b,c):a.removeAttribute(b);pga(a)},rOb=function(){oOb\|\|(oOb=!0,pOb=Hfa,Hfa=function(a){pOb&&pOb(a);for(var b=0;b<a.length;b++){var c=a[b];xf(c)&&.Qf(c).wBa(c)}},qOb=Ifa,Ifa=function(a){qOb&&qOb(a);for(var b=0;b<a.length;b++){var c=a[b];xf(c)&&Qf(c).xBa(c)}})},sOb=function(a){if(a=a\|\|document.body){var b=document.head.querySelector("style[data-late-css]");a=n(Array.from(a.querySelectorAll("style[data-server-css-collection], link[data-server-css-collection]")));for(var c=a.n

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.758217138015706
Encrypted:	false
SSDEEP:
MD5:	BA6AB51487CFAEF8F7E56133C34AAE37
SHA1:	19DF244D1D07FF43020A7B001A5B27498507CB7D
SHA-256:	FB20FC7C1F7CFCF723EFCEE54434C316E05EE614F707502344330828FFC1CC98
SHA-512:	95EC94EE16487C430C45E98CF822425F2C7934F69CA257C5E20B1F9E659D6BBF6519E09AD65CE18DA8CA3786D477FC93286F3C6C6AAA1C08B319A4B9AAE854EA
Malicious:	false
Reputation:	unknown
Preview:	{. "error": {. "code": 403,. "message": "Requests from referer \u003cempty\u003e are blocked.",. "status": "PERMISSION_DENIED",. "details": [. {. "@type": "type.googleapis.com/google.rpc.ErrorInfo",. "reason": "API_KEY_HTTP_REFERRER_BLOCKED",. "domain": "googleapis.com",. "metadata": {. "service": "blobcomments-pa.googleapis.com",. "consumer": "projects/298134251447". }. }. ]. }.}.

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3383)
Category:	downloaded
Size (bytes):	109002
Entropy (8bit):	5.487228566621995
Encrypted:	false
SSDEEP:
MD5:	36D3ED351F0A1F94ECA1D05622680ACC
SHA1:	1934F936AC5C609F5DA9999E6632F9428AB65AE1
SHA-256:	7E2ECEE513FD3CEE859BA116561A5A71EA95A8F89C9294397945FD4787BA2D13
SHA-512:	01506714F6E320AE6DBE5E20D6315B2A5621D3228984F084CE36BA52D8BD746648802F486209A99D144A752FA07FD8E8BE0847D39C0CA655EC0A97CEDBCA7205
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Preview:	(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},da=ca(this),r=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.r("Symbol",function(a){if(a)return a;var b=function(g,f){this.wc=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.wc};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3170
Entropy (8bit):	7.934630496764965
Encrypted:	false
SSDEEP:
MD5:	9D73B3AA30BCE9D8F166DE5178AE4338
SHA1:	D0CBC46850D8ED54625A3B2B01A2C31F37977E75
SHA-256:	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
SHA-512:	8E55D1677CDBFE9DB6700840041C815329A57DF69E303ADC1F994757C64100FE4A3A17E86EF4613F4243E29014517234DEBFBCEE58DAB9FC56C81DD147FDC058
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(...N_R."0`.-.A..\|.N..`....n..{.&..l.o..;.....a....d..$.................J.1......7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4\|.F...9......pP.8.\|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1843)
Category:	downloaded
Size (bytes):	949112
Entropy (8bit):	5.5537687495866015
Encrypted:	false
SSDEEP:
MD5:	66A44D3A629C292CF2B90D23DD7B77C0
SHA1:	BBEC295464861950F94289F983398BCE97173D86
SHA-256:	A5649DA6CF124BB6D834019D03BD07E419A3621C6CE01EEC8982C65E4C1E2AC1
SHA-512:	A958EF5371E9902C5BC0DE2BFFC95B5EEF61826731BA142F227DF76273A8233BECDC5D0C4972190966A1CCB1713A09A2E01C92CFFEFF9CF84CE000557B1F8641
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.7zJe3fq_zWU.O/am=gAE/d=0/rs=AO0039uv9ObcXgz9YyUk0XXtSXAwkFfwvQ/m=dSirkf,sy56,sy1m,n90YA,ZGAB2e,sLGWFe,sy1h,sy2n,sy1o,sy2o,sy13,M79aPc,syq,sys,sy10,sy1j,sy1n,sy1u,sy2h,sy2t,sy32,sy3d,sy3o,sy3k,sy3u,sy4x,nJ4XF,sy57,sy58,sy59,UKcSG,AtsVYc"
Preview:	try{.w("dSirkf");..x();.}catch(e){_DumpException(e)}.try{.w("n90YA");.var IJc=new Fq;IJc.altKey=!0;IJc.keyCode=39;(new Fq).keyCode=13;.x();.}catch(e){_DumpException(e)}.try{.w("ZGAB2e");..x();.}catch(e){_DumpException(e)}.try{.w("sLGWFe");..x();.}catch(e){_DumpException(e)}.try{.var GM=function(a){this.da=p(a)};P(GM,v);GM.prototype.Qk=function(){return Mi(this,7)};var HM=function(a){this.da=p(a)};P(HM,v);HM.prototype.getName=function(){return E(this,4)};HM.prototype.Fc=function(a){return z(this,4,a)};HM.prototype.Mp=function(){return E(this,11)};var IM=function(a){this.da=p(a)};P(IM,v);IM.prototype.getInfo=function(){return O(this,HM,1)};IM.prototype.Er=function(){return O(this,GM,3)};.}catch(e){_DumpException(e)}.try{.var TXb=function(){return B('<span class="'+D(ou("OiePBf-zPjgPe",void 0))+'"></span>')},UXb=function(a){this.da=p(a)};P(UXb,v);UXb.prototype.getSeconds=function(){return He(this,1)};var VXb=function(){return bu('data-sync-idom-state="true"')};.}catch(e){_DumpException(e)

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34108, version 1.0
Category:	downloaded
Size (bytes):	34108
Entropy (8bit):	7.993096562158293
Encrypted:	true
SSDEEP:
MD5:	C15D33A9508923BE839D315A999AB9C7
SHA1:	D17F6E786A1464E13D4EC8E842F4EB121B103842
SHA-256:	65C99D3B9F1A1B905046E30D00A97F2D4D605E565C32917E7A89A35926E04B98
SHA-512:	959490E7AE26D4821170482D302E8772DD641FFBBE08CFEE47F3AA2D7B1126DCCD6DEC5F1448CA71A4A8602981966EF8790AE0077429857367A33718B5097D06
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2.......<..........................................\..4?HVAR.t.`?STAT..'...J/<.....`..(..Z.0..,.6.$.... ..B..K..[.h...c.....nC .../.V.v..6>nT.R...b.8.@.......ON.ch.......k..."..".9..\D...JBJ."T%5...Z2..Q.)wJ...sA.h..m....n..F.....t..ig.=..y.s@............t..j.....n.h(...........N..)9.....v`\|z....8.7..kTq....^.......[.K.O..1ZP.....;.HP.......>..+..j:.V.......A......[.f.l..v`x....F_..vo...e....n...H..X.2.v}...(.1J...x.....}.....5.3.....?..?..7...S..0.9..C.0.M..M9..e.b....bc..b4.0"e.G.....XT....z............E'c.(."...x`].]..e.rQ..ye.z........kFh;....Y.yPt.._Q.._-q..mi.Og.W.-qUI...m5..r.mvA~o....S.f........s..ql.aXD...H..wy.P..k...f$.V^.2...8U{...f.....]]..G..cf.......D.c&B'S.2~..N..........R;..).5...../... 6....b....]d6."C..T..........OI\+V'...E.[.g.u.E....,!F.....*U.q. :x.s..1..C....H..S%..)....h......K..........pw.f...f.......an3....9....@......%.2.c.+........cXD..F...B.....0'...O.z8.B....4...\..&c...H....;..p....@.l...:........L..`...5..xo&.

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	4.60225951443478
Encrypted:	false
SSDEEP:
MD5:	6039D9538B540E3FA5FAB7AC2F0E9B3F
SHA1:	521A01A2E30C2B56F7370279D8CAF0274084530F
SHA-256:	68873BF5EA92130325AF1B25021AA30A4A1EBC0BD5900B3540E8F6B578B4596A
SHA-512:	5786161CBDC5C0E187522AC1523C7BEFB7DEA21A6F9DDD8A1962C8532E9CA9940743F3152486E3E8FAA9226F70A0B48969FE0B1945B283BD838B376BE569D528
Malicious:	false
Reputation:	unknown
Preview:	{. "error": {. "code": 403,. "message": "Requests from referer \u003cempty\u003e are blocked.",. "errors": [. {. "message": "Requests from referer \u003cempty\u003e are blocked.",. "domain": "global",. "reason": "forbidden". }. ],. "status": "PERMISSION_DENIED",. "details": [. {. "@type": "type.googleapis.com/google.rpc.ErrorInfo",. "reason": "API_KEY_HTTP_REFERRER_BLOCKED",. "domain": "googleapis.com",. "metadata": {. "consumer": "projects/847707997455",. "service": "drive.googleapis.com". }. }. ]. }.}.

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	EC331136E75314D2030EE013B6069921
SHA1:	6B7428B8B15616A67F767D42964AF94FCBE2A803
SHA-256:	A7358DF6B7B60280F2A0D7CD5B70A9F1DFA4FCE5C31FB1A24FB2F109AF7EE977
SHA-512:	30C9B411C937F7D3DE9E59D8BE1CDE4F262B05C6AC2EC2D2C1956E705FE255D84DE17913826A0378B7FD4E51E075EE72A6BF16B870BF78B83D4F1D4507A44278
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmlNHcUu78_khIFDQbtu_8=?alt=proto
Preview:	CgkKBw0G7bv/GgA=

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2121)
Category:	downloaded
Size (bytes):	120458
Entropy (8bit):	5.5013823425434225
Encrypted:	false
SSDEEP:
MD5:	4946E441A6612999602214249EDF6075
SHA1:	F963393FBFDC741D58964234E617ABDD2336CDC4
SHA-256:	70CD320339737C378A73B9837EFEAF4F1B233315873FE5B1FF7128AB8F82BF2D
SHA-512:	851CA5BF5A7E84D742233AEBCE0E5CA458CF47F18DD0C66CFA7D621C1B95F8243F31758D6E754D6EFB3F58DABD85E4109C654CC1FF6C26A7DD7BFB9F1EDF60A9
Malicious:	false
Reputation:	unknown
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uvrmm4sgViM.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_AfeXEgP9UD-iQrKiwqZLadQ_cBg/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var da,ma,na,sa,ta,ya,Ca,Ea;_.ca=function(a){return function(){return _.ba[a].apply(this,arguments)}};_.ba=[];da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ma="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.na=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.qa=na(this);sa=function(a,b){if(b)a:{var c=_.qa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b

Static File Info

⊘No static file info

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_01b8f5a5-bc66-45ef-aa18-8c689e24d4c3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_59f87023-7e98-46fa-b9bf-9fd68f1f11fb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_7c5edfb8-94cc-44c6-b5b8-501c500f21df\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Basketball court_66cd88d07e3dc69fb61476c8628af1fac4e3dd8_1ed34277_853fa412-d11e-42b2-a06e-0036eb8cfb88\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER258B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29A3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29C4.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER457.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER862F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER89F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A50.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A66.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A86.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E49.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E69.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2FB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB713.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB733.tmp.xml

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\Basketball court short version 3-18-24.exe (copy)

C:\Users\user\Downloads\Unconfirmed 75163.crdownload

C:\Windows\appcompat\Programs\Amcache.hve

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Windows Analysis Report
https://drive.google.com/file/d/1sXNMWYhWddKXv_kCgAKwr0JbUOh92VfC/view?usp=drive_web__;!!EvuEbwJvtYU!hX3qgZLVsnnlzGLSO-nK5A0pPClpa_LYwFKYUOTE-npzFgqOUUxE_g1OWw9h_aaJf6BIxIy0ARGU3yeccf2k02Q%24