Windows Analysis Report
0e46.scr.exe

Overview

General Information

Sample name:	0e46.scr.exe renamed because original name is a hash value
Original sample name:	.scr.exe
Analysis ID:	1436303
MD5:	77dcf984a36098a6e855c54fa36cd5f7
SHA1:	2fe61c4bbfa471c000e28f15373c33559d60e25d
SHA256:	59519819b7d8381418c3bcc7448c8702e19ca46a65c5e9f6823fce90d9603564
Tags:	AgentTeslaexescr
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Signatures

AV Detection

Found malware configuration

Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "cp5ua.hyperhost.ua", "Username": "projectlog@aflacltd.top", "Password": " 7213575aceACE@# "}

Multi AV Scanner detection for submitted file

Source: 0e46.scr.exe	Virustotal: Detection: 70%			Perma Link
Source: 0e46.scr.exe	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: 0e46.scr.exe

Joe Sandbox ML: detected

Source: https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	HTTP Parser: No favicon
Source: https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	HTTP Parser: No favicon
Source: https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	HTTP Parser: No favicon

Uses 32bit PE files

Source: 0e46.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49725 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.247.96.147:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.247.96.147:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49742 version: TLS 1.2

Source: 0e46.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: 0e46.scr.exe, 00000000.00000002.2003160997.0000000005590000.00000004.08000000.00040000.00000000.sdmp, 0e46.scr.exe, 00000000.00000002.2001431433.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 91.235.128.141:587

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 91.235.128.141 91.235.128.141

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 91.235.128.141:587

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49725 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.96.147
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Dg+uS4uaRpFXHHv&MD=p8faHFV4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en HTTP/1.1Host: ogs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Dg+uS4uaRpFXHHv&MD=p8faHFV4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=EYr6cnrRAAEbx9B9S_C9cajnLlaQBUmKFyzMrUZBAei_V9LOYiMmisV7U6YkKONCPJujzzrOGtgJy-9KwtEqX54XUPzbdgb3ce54RAyN2Dm9W0bQ1cITNvw07xv6LQ9qFjNMhp5tHHb8WTnaZfrfWxGxfg3yeVVD9myKTJFBkTU

Source: global traffic	DNS traffic detected: DNS query: cp5ua.hyperhost.ua
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 787sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: text/plain;charset=UTF-8X-Goog-AuthUser: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://ogs.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ogs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=XmH_gibrb4C3PvdgFV5OZbumoUeiL2En-lB_mjdL1cfaDi8oeDU1Od-r8cqdfqnp62p7q5vvXgHyq3CODyYE3k6oDEfBhu8op1NMjAiitcAwEd0n2u33siAF_uBH7vM5Q-64c9VE5vLTbIJZQ3q3pkF8-Rst9oPmLdWSZE3mJSc

Source: 0e46.scr.exe, 00000001.00000002.3250604761.0000000002446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cp5ua.hyperhost.ua
Source: 0e46.scr.exe, 00000001.00000002.3250604761.0000000002446000.00000004.00000800.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3249400772.0000000000786000.00000004.00000020.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3253781324.0000000005E82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 0e46.scr.exe, 00000001.00000002.3253781324.0000000005EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 0e46.scr.exe, 00000001.00000002.3250604761.0000000002446000.00000004.00000800.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3249400772.0000000000786000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: 0e46.scr.exe, 00000001.00000002.3250604761.0000000002446000.00000004.00000800.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3249400772.0000000000786000.00000004.00000020.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3253781324.0000000005E82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 0e46.scr.exe, 00000001.00000002.3250604761.0000000002446000.00000004.00000800.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3249400772.0000000000786000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: chromecache_77.5.dr	String found in binary or memory: http://www.broofa.com
Source: 0e46.scr.exe, 00000000.00000002.2001634046.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3249046802.0000000000502000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: chromecache_90.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_90.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_90.5.dr, chromecache_77.5.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_81.5.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_90.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_90.5.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_90.5.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_90.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_77.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_77.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_77.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_77.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_92.5.dr	String found in binary or memory: https://ogs.google.com/
Source: chromecache_92.5.dr	String found in binary or memory: https://ogs.google.com/widget/app/so
Source: chromecache_77.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_90.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_90.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: 0e46.scr.exe, 00000001.00000002.3250604761.0000000002446000.00000004.00000800.00020000.00000000.sdmp, 0e46.scr.exe, 00000001.00000002.3249400772.0000000000786000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: chromecache_92.5.dr	String found in binary or memory: https://ssl.gstatic.com
Source: chromecache_81.5.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_90.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_81.5.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_90.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_90.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_92.5.dr	String found in binary or memory: https://www.gstatic.com
Source: chromecache_92.5.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.atEDuNh539g.
Source: chromecache_77.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_77.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_77.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.247.96.147:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.247.96.147:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49742 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, 8WWn.cs	.Net Code: PiOIPdZen
Source: 0.2.0e46.scr.exe.3fef9f0.4.raw.unpack, 8WWn.cs	.Net Code: PiOIPdZen

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.0e46.scr.exe.402a420.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.0e46.scr.exe.3fef9f0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.0e46.scr.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.0e46.scr.exe.54b0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.0e46.scr.exe.3f0dd90.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.0e46.scr.exe.3f0dd90.2.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.0e46.scr.exe.54b0000.5.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.0e46.scr.exe.3fef9f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.0e46.scr.exe.2eb1ba0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.0e46.scr.exe.2eaf360.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000000.00000002.2002461828.00000000054B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects downloader injector Author: ditekSHen

Detected potential crypto function

Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 0_2_0145AA28	0_2_0145AA28
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 0_2_01459150	0_2_01459150
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_0238B06F	1_2_0238B06F
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02384A98	1_2_02384A98
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02383E80	1_2_02383E80
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_0238CE80	1_2_0238CE80
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_023841C8	1_2_023841C8
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02389BF8	1_2_02389BF8
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_0599BCF0	1_2_0599BCF0
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_0599DCF0	1_2_0599DCF0
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_05993F38	1_2_05993F38
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_059956C8	1_2_059956C8
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_05992EE8	1_2_05992EE8
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_05990040	1_2_05990040
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_05998B73	1_2_05998B73
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_05994FE8	1_2_05994FE8
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_05993623	1_2_05993623
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_0238D230	1_2_0238D230

Sample file is different than original file name gathered from version info

Source: 0e46.scr.exe, 00000000.00000002.2002461828.00000000054B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000000.00000002.2003160997.0000000005590000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000000.00000002.2001431433.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000000.00000002.2001431433.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename96d8990f-a506-4040-ac41-4524d69afa68.exe4 vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000000.00000002.2001634046.0000000003EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000000.00000002.2001634046.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename96d8990f-a506-4040-ac41-4524d69afa68.exe4 vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000000.00000000.1994785634.0000000000AC6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedxdiag.exel% vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000001.00000002.3249046802.0000000000502000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename96d8990f-a506-4040-ac41-4524d69afa68.exe4 vs 0e46.scr.exe
Source: 0e46.scr.exe, 00000001.00000002.3249010467.00000000004F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 0e46.scr.exe
Source: 0e46.scr.exe	Binary or memory string: OriginalFilenamedxdiag.exel% vs 0e46.scr.exe

Uses 32bit PE files

Source: 0e46.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 0.2.0e46.scr.exe.402a420.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.0e46.scr.exe.3fef9f0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.0e46.scr.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.0e46.scr.exe.54b0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.0e46.scr.exe.3f0dd90.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.0e46.scr.exe.3f0dd90.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.0e46.scr.exe.54b0000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.0e46.scr.exe.3fef9f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.0e46.scr.exe.2eb1ba0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.0e46.scr.exe.2eaf360.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000000.00000002.2002461828.00000000054B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector

Source: 0e46.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.0e46.scr.exe.3f0dd90.2.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.0e46.scr.exe.3f0dd90.2.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.0e46.scr.exe.54b0000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/39@11/7

Source: C:\Users\user\Desktop\0e46.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0e46.scr.exe.log

Source: C:\Users\user\Desktop\0e46.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\0e46.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\0e46.scr.exe "C:\Users\user\Desktop\0e46.scr.exe"
Source: C:\Users\user\Desktop\0e46.scr.exe	Process created: C:\Users\user\Desktop\0e46.scr.exe "C:\Users\user\Desktop\0e46.scr.exe"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2040,i,3301420170973166231,14062020265948935474,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\0e46.scr.exe	Process created: C:\Users\user\Desktop\0e46.scr.exe "C:\Users\user\Desktop\0e46.scr.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2040,i,3301420170973166231,14062020265948935474,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Section loaded: msasn1.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02380600 push eax; ret	1_2_02380712
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02380600 push eax; ret	1_2_02380732
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_023806C8 push eax; ret	1_2_02380702
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02380728 push eax; ret	1_2_02380732
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02380718 push eax; ret	1_2_02380722
Source: C:\Users\user\Desktop\0e46.scr.exe	Code function: 1_2_02380708 push eax; ret	1_2_02380712

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\0e46.scr.exe	Memory allocated: 1450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Memory allocated: 23F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\0e46.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\0e46.scr.exe	Window / User API: threadDelayed 1230			Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Window / User API: threadDelayed 7852			Jump to behavior

Source: C:\Users\user\Desktop\0e46.scr.exe TID: 528	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99870s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4416	Thread sleep count: 1230 > 30	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4416	Thread sleep count: 7852 > 30	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99106s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98753s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -97092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96545s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -96109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95994s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -95109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe TID: 4068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: 0e46.scr.exe, --.cs	Reference to suspicious API methods: _FFFDt_26CA.OpenProcess(_06DA_FFFD, _FFFD_FFFDZ_FFFD, _FFFD_06DA_FFFD)
Source: 0e46.scr.exe, ---.cs	Reference to suspicious API methods: _FFFDt_26CA.GetAsyncKeyState(16)
Source: 0e46.scr.exe, R-.cs	Reference to suspicious API methods: _FFFDt_26CA.MapVirtualKey(i_FFFD.union.keyboardInput.wVk, 0)
Source: 0.2.0e46.scr.exe.5590000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.0e46.scr.exe.5590000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.0e46.scr.exe.5590000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Source: 0e46.scr.exe	Binary or memory string: Progman
Source: 0e46.scr.exe	Binary or memory string: IsProgmanWindow
Source: 0e46.scr.exe	Binary or memory string: tUser32FocusedMenuhwndMenuhMenuNonClientSysMenuRawTextRange_ScrollIntoViewRawScrollItemPattern_ScrollIntoViewget_CurrentViewRawMultipleViewPattern_SetCurrentViewget_Rowget_WindowIsKnownBadWindowRawUiaEventAddWindowGetFirstOrLastOwnedWindowGetFocusedWindowRawUiaEventRemoveWindowFindModalWindowIsTopLevelWindowIsProgmanWindowIsTransformPatternWindowIsWindowPatternWindowGetDesktopWindowIsWindowSwitchToThisWindowGetWindowGetModuleFileNameExpt_xdxCZGwDCEsywxZZUZfkyhhxget_LabeledBypt_yInitializeArrayToArrayToCharArrayPropertyArrayToIntArrayConvertToElementArraydyIsExtendedKeyMapVirtualKeyVirtualKeyFromKeyget_AcceleratorKeyget_AccessKeyRegisterHotKeyUnregisterHotKeyget_AssemblyGetExecutingAssemblyRegisterClientSideProviderAssemblyGetAssemblyRegisterProxyAssemblyget_IsReadOnlyRaiseEventInThisClientOnlyIndexOfAnyOnEventObjectDestroyCopyget_NonClientMenuBarProxyFactoryget_NonClientProxyFactoryget_User32FocusedMenuProxyFactoryget_NonClientSysMenuProxyFactoryGetProxyFromEntryDictionaryEntryop_Equalityop_InequalityAccessibilitySystem.Securityget_EmptyIsNullOrEmptyget_IsEmptyget_PropertyRuntimeIdPropertyFrameworkIdPropertyAutomationIdPropertyProcessIdPropertyIsEnabledPropertyIsSelectionRequiredPropertyIsSelectedPropertyContainingGridPropertyIsPasswordPropertyLargeChangePropertySmallChangePropertyIsGridPatternAvailablePropertyIsInvokePatternAvailablePropertyIsTablePatternAvailablePropertyIsTogglePatternAvailablePropertyIsExpandCollapsePatternAvailablePropertyIsRangeValuePatternAvailablePropertyIsValuePatternAvailablePropertyIsDockPatternAvailablePropertyIsScrollPatternAvailablePropertyIsGridItemPatternAvailablePropertyIsTableItemPatternAvailablePropertyIsScrollItemPatternAvailablePropertyIsSelectionItemPatternAvailablePropertyIsTransformPatternAvailablePropertyIsSelectionPatternAvailablePropertyIsTextPatternAvailablePropertyIsMultipleViewPatternAvailablePropertyIsWindowPatternAvailablePropertyVerticallyScrollablePropertyHorizontallyScrollablePropertyIsKeyboardFocusablePropertyNativeWindowHandlePropertyBoundingRectanglePropertyCanSelectMultiplePropertyClassNamePropertyLocalizedControlTypePropertyItemTypePropertyCulturePropertyToggleStatePropertyExpandCollapseStatePropertyWindowVisualStatePropertyWindowInteractionStatePropertyCanRotatePropertyValuePropertyCanMovePropertyVerticalViewSizePropertyHorizontalViewSizePropertyCanMinimizePropertyCanMaximizePropertyCanResizePropertyIsModalPropertyIsRequiredForFormPropertyMinimumPropertyMaximumPropertyColumnSpanPropertyRowSpanPropertyIsOffscreenPropertyColumnPropertyAutomationPropertyOrientationPropertySelectionPropertyDockPositionPropertySelectionContainerPropertyRowOrColumnMajorPropertyHasPropertyColumnHeaderItemsPropertyRowHeaderItemsPropertyColumnHeadersPropertyRowHeadersPropertyHasKeyboardFocusPropertyItemStatusPropertySupportedViewsPropertyVerticalScrollPercentPropertyHorizontalScrollPercentPropertyIsControlElementPropertyIsContentElementPropertyClickablePointPropertyColumnCountPropertyRowCountPropertyIsTopmostPropert

Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Users\user\Desktop\0e46.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Users\user\Desktop\0e46.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: 0.2.0e46.scr.exe.402a420.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0e46.scr.exe.3fef9f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.0e46.scr.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0e46.scr.exe.402a420.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.0e46.scr.exe.3fef9f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3250604761.0000000002469000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3249046802.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3250604761.000000000243E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2001634046.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3250604761.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0e46.scr.exe PID: 652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0e46.scr.exe PID: 940, type: MEMORYSTR

Source: C:\Users\user\Desktop\0e46.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\0e46.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.68.110	unknown	United States	15169	GOOGLEUS	false
172.217.14.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
91.235.128.141	cp5ua.hyperhost.ua	Ukraine	15626	ITLASUA	false
142.250.72.142	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.189.14	play.google.com	United States	15169	GOOGLEUS	false

Name	IP	Active
cp5ua.hyperhost.ua	91.235.128.141	true
plus.l.google.com	142.251.40.46	true
www3.l.google.com	142.250.72.142	true
play.google.com	142.250.189.14	true
www.google.com	172.217.14.68	true
ogs.google.com	unknown	unknown
apis.google.com	unknown	unknown

Name	Malicious	Reputation
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	false	high
https://www.google.com/async/newtab_promos	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high

ID:	1436303
Product:	CloudBasic
Start time:	10:02:04
Start date:	04.05.2024
Sample:	0e46.scr.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	77dcf984a36098a6e855c54fa36cd5f7
SHA1:	2fe61c4bbfa471c000e28f15373c33559d60e25d
SHA256:	59519819b7d8381418c3bcc7448c8702e19ca46a65c5e9f6823fce90d9603564
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Windows Analysis Report 0e46.scr.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
0e46.scr.exe

Malware Threat Intel
Provided by

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0e46.scr.exe.log	ASCII text, with CRLF line terminators	9BA266AD16952A9A57C3693E0BCFED48	5DB70A3A7F1DB4E3879265AB336B2FA1AFBCECD5	A6DFD14E82D7D47195A1EC7F31E64C2820AB8721EF4B5825E21E742093B55C0E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat May 4 07:03:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	59ABD2A0D3645C471310BC2A7CCA67EF	F200F3D9AF3696CDCE96542D0D3401F6D3DCB68B	F0B0235DF9F502CDD7177871CC0C565F13561E393021AE60A9F2CFE164700723
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat May 4 07:03:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2485849E26F7860F084610D9E96C93E3	6B6C1CF4B4686027D78CD7041DAE290FCD3B7757	3003404AF924A041F900B3FD0C3D71D7E3FD7DDEEB43445C6DDD19113442C4FC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	D2DAE52A258DAA7C755CD1CCCEA86B81	5DBF53FAA090AA07A85A330E1C9A109910A8BE52	A3C63C62B0FF890FF27BA2B56C40FF6F8B4696EF34EAE50975C0F1CD5B8BEFBA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat May 4 07:03:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5095B9BF1547540B171EB54616117131	4573A6653265529BEEC508F1E5BB4A7B9C04B343	8793FDC4498CAC4606FCDA2970CB2CA8B3A2BB742C3EFD0DB58A6F723AF6EF53
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat May 4 07:03:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F3D509CDFEA9DD0EF6BC60A98664C3CD	8D5C1E602CFB817116A701986ED91F925222D92E	A1CC217FD603C3EEB8B8B2F68F5EB915A0572F73A068F6FD2465412AC504E4CF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat May 4 07:03:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	DE5458475BBD4CFE9BA03C6C2743537D	D6105AFF28A7C883182BBC978AB4BD6943514D3C	19A5934F957A35461891CF40ACFBD17B5D9F371D4E35F2B34344D5B3965932D4
Chrome Cache Entry: 76	ASCII text, with very long lines (1657)	951F5CB1728D3C62E6006801A61D2BE3	3B9B0CD9203226263F8E32B336ADC5532E54A308	A50889187D77C8E3E0439A0D5C155159EAA7A3DBEC35111D7131EC88C0A228F7
Chrome Cache Entry: 77	ASCII text, with very long lines (2294)	9D9987F6E83F101A097A0BD64A14C71B	E71E10897E0E874DE4D12125D5DF2F7FCE08F585	D0975FC00A61201A54714BE8DF5E50F02B277E133BA08ABD9DEEA33934FA28A9
Chrome Cache Entry: 78	ASCII text, with very long lines (814)	9F7DFE32AF79D1BCB335AEB18EA88923	2CDD844795A521BC02FAE6D6F36F8FC1C6FD0174	D1ACFF199C5949F2C139FFCEB6B8868A514D391C32B019DACBF64C6084DA0ABD
Chrome Cache Entry: 79	ASCII text, with very long lines (2956)	676CD2F5702D832A1E3E2F08257FEB37	1019B84107A8F84A77A651BDCBE0A7F425DE3661	F58B6E0D4393A8BB15423EC49867875FB38EB820E0A7D13A7E80F4DCE7EB342E
Chrome Cache Entry: 80	PNG image data, 106 x 5210, 8-bit/color RGBA, non-interlaced	387ED93F42803B1EC6697E3B57FBCEF0	2EA8A5BFBF99144BD0EBAEBE60AC35406A8B613E	982AAC952E2C938BD55550D0409ECE5F4430D38F370161D8318678FA25316587
Chrome Cache Entry: 81	ASCII text, with very long lines (2200)	92EEFFE57524E80329BE5C39E3442D12	EAA1A2226A503A59A2506BFC5031077DBED51AE1	A206F391DFA17782AF610C772392E25F2DF7EA947A7CE17B449ACF45DD5BF854
Chrome Cache Entry: 82	ASCII text	6FED308183D5DFC421602548615204AF	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
Chrome Cache Entry: 83	ASCII text, with very long lines (736)	6745EB04C880EA1849D0DD81B61F4FE9	EF6EDD0581F24E02C423FBC551B9D9F060F2404C	F196C197EF86BA3427D8284E2273FE8932BBC2AFF02931E4273F6840927518B2
Chrome Cache Entry: 84	ASCII text, with very long lines (3572), with no line terminators	122C0858F7D38991F14E5ADC6BDB3C3B	FFC64755EB42990A73C4878426A641CFB94B57EE	06D1296A6F6611AC795B27882FE88823EE857D0F49F7018CF00C6A199976DC0D
Chrome Cache Entry: 85	ASCII text, with very long lines (769)	13D1BE6BC9AA2CA332D553D2D4491DE1	F7E7A540E69006ED7470EB2AED4EF19BE4A1AF0C	4C205DD66FDACFF32EB2B63273FB74DB1E29DBD5C9B97F0F6641378174257F39
Chrome Cache Entry: 86	ASCII text, with very long lines (65531)	4630FEC6612229DEAF27D17817739538	031FA6BFD2B255CC17506FF37E30BD97D51BB78F	DA08B73A6E01EEB45AC75A5AD195797D6C67B20ECFAFCF565232F0D0BE49CF92
Chrome Cache Entry: 87	PNG image data, 106 x 5210, 8-bit/color RGBA, non-interlaced	387ED93F42803B1EC6697E3B57FBCEF0	2EA8A5BFBF99144BD0EBAEBE60AC35406A8B613E	982AAC952E2C938BD55550D0409ECE5F4430D38F370161D8318678FA25316587
Chrome Cache Entry: 88	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 89	SVG Scalable Vector Graphics image	554640F465EB3ED903B543DAE0A1BCAC	E0E6E2C8939008217EB76A3B3282CA75F3DC401A	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
Chrome Cache Entry: 90	ASCII text, with very long lines (2124)	F46ACD807A10216E6EEE8EA51E0F14D6	4702F47070F7046689432DCF605F11364BC0FBED	D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
Chrome Cache Entry: 91	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	FBE36EB2EECF1B90451A3A72701E49D2	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
Chrome Cache Entry: 92	HTML document, ASCII text, with very long lines (21071)	1A43E805647D50EAE2087AA180E4FB15	81A772CC83C391C9F0C1F15B76E56106E080723A	5DDD489EEDACC505DE6F83C6511FE954FB71CE8F73325F15C0483D175F135CD2