Benign windows Download

fnox

Windows Credential Manager enumeration and readingGNU Bison parser-generator name

SHA-25614c907cc68d75b8a1e87c8116a17504fcae7f1d15382b5b889bd5adc2ee5dd42

URLhttps://github.com/jdx/fnox/releases/download/v1.35.2/fnox-aarch64-pc-windows-msvc.zip

MaleculeK(Li)O(Ca₂)H₆(Cm₁₂Cr₉DsF₇Os₁₃Po₅)Md₄(Bi₂Bk₂Pt)

Evidence

Large Rust native library with many exports 0x0–0xb0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
⋯9 more rows

OpenSSL cryptographic library 0x1924ba1–0x1924c81

⋯3 more rows
0x1924bd174696f6e20666f722041524d76382c20tion for ARMv8, 
0x1924be143525950544f47414d53206279203c61CRYPTOGAMS by <a
0x1924bf17070726f406f70656e73736c2e6f7267[email protected]
0x1924c013e00001f2003d51f2003d51f2003d5f3>... ... ... ...
0x1924c1153bea9fe0b00f9800000b4f30300aa00S...............
⋯7 more rows

CRYPTOGAMS assembly attribution string 0x1925825–0x1925905

⋯3 more rows
0x19258554841534820666f722041524d76382c20HASH for ARMv8, 
0x192586543525950544f47414d53206279203c61CRYPTOGAMS by <a
0x19258757070726f406f70656e73736c2e6f7267[email protected]
0x19258853e00000000000000000000317c404c33>..........1|@L3
0x1925895e4074f7356794f2342116e7206416f31..OsVyO#B.nr.Ao1
⋯7 more rows

Enumerate stored Windows credentials 0x1d23fd8–0x1d242c8

0x1d23fd84200000000000000636f6e6669675f66B.......config_f
0x1d23fe8696c65746f6b656e6164647265737370iletokenaddressp
0x1d23ff86174686e616d65737061636563726564athnamespacecred
0x1d24008656e7469616c5f636f6d6d616e64626cential_commandbl
0x1d240186f627365727669636573747275637420observicestruct 
0x1d2402876617269616e742050726f7669646572variant Provider
0x1d24038436f6e6669673a3a4b6579636861696eConfig::Keychain
0x1d240482077697468203420656c656d656e7473 with 4 elements
0x1d24058215ad241010000003700000000000000!Z.A....7.......
0x1d240687374727563742076617269616e74204cstruct variant L
0x1d24078656173654261636b656e64436f6e6669easeBackendConfi
0x1d24088673a3a41777353747320776974682035g::AwsSts with 5
0x1d2409820656c656d656e747300000000000000 elements.......
0x1d240a8685ad241010000003900000000000000hZ.A....9.......
0x1d240b8726563697069656e74736b65795f6669recipientskey_fi
0x1d240c86c656964656e74697479737472756374leidentitystruct
0x1d240d82076617269616e742050726f76696465 variant Provide
0x1d240e872436f6e6669673a3a416765456e6372rConfig::AgeEncr
0x1d240f8797074696f6e2077697468203520656cyption with 5 el
0x1d24108656d656e74730000d25ad24101000000ements...Z.A....
0x1d241183c00000000000000736572766963655f<.......service_
0x1d241286163636f756e745f656d61696c73636faccount_emailsco
0x1d24138706573656e765f766172737472756374pesenv_varstruct
0x1d241482076617269616e74204c656173654261 variant LeaseBa
0x1d24158636b656e64436f6e6669673a3a476370ckendConfig::Gcp
0x1d2416849616d2077697468203420656c656d65Iam with 4 eleme
0x1d241786e74730000000000425bd24101000000nts.....B[.A....
0x1d24188390000000000000063726564656e74699.......credenti
0x1d24198616c5f696473616c7472705f69647069al_idsaltrp_idpi
0x1d241a86e7374727563742076617269616e7420nstruct variant 
0x1d241b850726f7669646572436f6e6669673a3aProviderConfig::
0x1d241c84669646f322077697468203620656c65Fido2 with 6 ele
⋯3 more rows
0x1d242082076617269616e74204c656173654261 variant LeaseBa
0x1d24218636b656e64436f6e6669673a3a566175ckendConfig::Vau
0x1d242286c742077697468203820656c656d656elt with 8 elemen
0x1d242387473000000000000025cd24101000000ts.......\.A....
0x1d24248380000000000000064617461626173658.......database
0x1d242586b657966696c6570617373776f726473keyfilepasswords
0x1d2426874727563742076617269616e74205072truct variant Pr
0x1d242786f7669646572436f6e6669673a3a4b65oviderConfig::Ke
0x1d2428865506173732077697468203520656c65ePass with 5 ele
0x1d242986d656e7473000000675cd24101000000ments...g\.A....
⋯3 more rows

Resolve endpoint with getaddrinfo 0x1d24370–0x1d24660

⋯8 more rows
0x1d243f000000000000000000000000000000000................
0x1d244000100000000000000d488334001000000..........3@....
0x1d2441000000000000000000000000000000000................
0x1d244200100000000000000d488334001000000..........3@....
0x1d2443000000000000000000000000000000000................
0x1d244400100000000000000d488334001000000..........3@....
0x1d2445000000000000000000000000000000000................
0x1d244600100000000000000d488334001000000..........3@....
0x1d2447000000000000000000000000000000000................
⋯5 more rows
0x1d244d000000000000000000000000000000000................
0x1d244e00100000000000000d488334001000000..........3@....
0x1d244f000000000000000000000000000000000................
0x1d245000100000000000000d488334001000000..........3@....
0x1d2451000000000000000000000000000000000................
0x1d245200100000000000000d488334001000000..........3@....
0x1d2453000000000000000000000000000000000................
0x1d245400100000000000000d488334001000000..........3@....
0x1d2455000000000000000000000000000000000................
0x1d245600100000000000000d488334001000000..........3@....
0x1d2457000000000000000000000000000000000................
0x1d245800100000000000000d488334001000000..........3@....
0x1d2459000000000000000000000000000000000................
0x1d245a00100000000000000182d234001000000.........-#@....
0x1d245b000000000000000000000000000000000................
0x1d245c001000000000000002c89334001000000........,.3@....
0x1d245d000000000000000000000000000000000................
0x1d245e0010000000000000054e22d4001000000........T.-@....
0x1d245f000000000000000000000000000000000................
0x1d24600010000000000000054e22d4001000000........T.-@....
0x1d2461000000000000000000000000000000000................
0x1d24620010000000000000074e22d4001000000........t.-@....
0x1d2463000000000000000000000000000000000................
0x1d246400100000000000000bc03414001000000..........A@....
0x1d2465000000000000000000000000000000000................
0x1d24660010000000000000024412b4001000000........$A+@....

No evidence locations were recorded for this file. Raw result