Benign windows Download

garnet

Compact mapped image with embedded stagesAuthenticode chain CN: Microsoft Corporation

SHA-256dd0cdb8e770c7bfb7f9fd498438c74644e3a3b6715d4248cc0e59ad8d0a032b2

URLhttps://github.com/microsoft/garnet/releases/download/v2.1.8/win-arm64-based-readytorun.zip

MaleculeK₃(Li₂LuMc₂)O₈(AlAs₈C₉CaEr₁₂EuPPr)H₉(Cm₁₅Cr₁₀Db₁₆F₁₆MgOs₁₃Po₁₅TiU)Md₆(Bi₁₈Bk₂Pa₂PtSi₄)

Evidence

Large PE with elevated code entropy 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400100100b010020291100240f91f0010eb..........@.....
0x41041000054c0035fd6fd7bbea9fd030091A..T.._..{......
0x420100100b010020291110100b031020391............1...
0x430100240f9310240f9f04701a9a5400094[email protected][email protected]...@..
0x44000003ed4000000000000000000000000..>.............
0x450100100b0106a40b9900000360000e1b8[email protected]....
0x4600000010bc0035fd6f00000b402fc5f88......_......._.
0x4704300010b03fc1088b0ffff35e003032aC..........5...*
0x480c0035fd66ffeff106200001400000000.._.o...b.......
0x490100100b0106a40b990000036000021b8[email protected]..!.
0x4a00000010bc0035fd6f00000b4027c5f88......_......|_.
0x4b04300010b037c1088b0ffff35e003032aC....|.....5...*
0x4c0c0035fd66ffeff105200001400000000.._.o...R.......
0x4d0100100b0106a40b99000003601fce2c8[email protected]....
0x4e0e00302aac0035fd6100100b403fc5fc8......_......._.
0x4f07f0002eb6100005401fc10c890ffff35....a..T.......5
0x500e00303aac0035fd64ffeff1041000014......_.O...A...
0x51001008012cfffff170000000000000000................
0x520100100b0106a40b9700000360080a1b8[email protected]....
0x530c0035fd6d00000b402fc5f88017c1088.._......._..|..
0x540d0ffff35e003022ac0035fd6affeff10...5...*.._.....
0x550300000140000000000000000000000000...............
0x560100100b0106a40b9700000360080e1f8[email protected]....
0x570c0035fd6d00000b402fc5fc801fc10c8.._......._.....
0x580d0ffff35e00302aac0035fd6affeff10...5......_.....
0x59020000014000000000000000000000000 ...............
0x5a021008052abffff170000000000000000!..R............
0x5b021008052b7ffff170000000000000000!..R............
0x5c0100040b9b10380d21100b8f21f02116b[email protected]
0x5d081010054508440f9110240b9316a1b12...TP.@[email protected]..
0x5e00f4888520fa7ba72ff01116ba1000054.H.R...r...k...T
0x5f010120091508400f900008052c0035fd6....P......R.._.
0x60020008052c0035fd60000000000000000 ..R.._.........
0x6101000b0d2110100b0306a00b9100080d2........0j......
0x620504238d5100e42d3100100b4100638d5PB8...B.......8.
0x630105e54d31f0a00f1f0379f9a100261b2.^T......7....a.
0x640306a00b9e0011fd6d0ffafd2105a4a390j...........ZJ9
0x650fbffff17000000000000000000000000................
0x660ff4300d1110100b0314240f9f16331cb[email protected].
0x670f10700f9c0035fd60000000000000000......_.........

Lowercase alphanumeric character set 0x16fd0–0x17290

⋯7 more rows
0x17040703d004001000000803d004001000000p=.@.....=.@....
0x170501040004001000000d03f004001000000.@.@.....?.@....
0x170603040004001000000b0400040010000000@.@.....@.@....
0x1707040410040010000003041004001000000@[email protected].@....
0x17080b041004001000000a041004001000000[email protected].@....
0x1709050420040010000001042004001000000[email protected].@....
0x170a03043004001000000e042004001000000[email protected].@....
0x170b008db014001000000a03a004001000000...@.....:.@....
0x170c0f0150040010000002d00000000000000[email protected].......
0x170d0303132333435363738396162636465660123456789abcdef
0x170e06768696a6b6c6d6e6f70717273747576ghijklmnopqrstuv
0x170f07778797a0000000000002115110e0d0cwxyz......!.....
0x171000b0b0a0a090909090908080808080808................
0x1711007070707070707070707070707000000................
0x17120303132333435363738396162636465660123456789abcdef
0x171306768696a6b6c6d6e6f70717273747576ghijklmnopqrstuv
0x171407778797a0000000000004129211c1917wxyz......A)!...
0x171501615141312121111111010100f0f0f0f................
0x171600e0e0e0e0e0e0e0d0d0d0d0d0d000000................
0x1717020810140010000003882014001000000 [email protected]..@....
0x17180d0830140010000002084014001000000...@.... ..@....
0x1719078840140010000002885014001000000x..@....(..@....
0x171a048850140010000001000000016000000H..@............
0x171b0030000000c0000000100000024000000............$...
0x171c00b00000000000000a0db014001000000...........@....
0x171d0900b014001000000c032024001000000[email protected].@....
0x171e060330240010000000000000000000000`3.@............
0x171f029000080010000000000000000000000)...............
0x1720000000000000000000f00000000000000................
⋯9 more rows

Current-user Windows registry hive 0x1a410–0x1a550

⋯3 more rows
0x1a44059005f00500041005400480000000000Y._.P.A.T.H.....
0x1a45048004b00450059005f00430055005200H.K.E.Y._.C.U.R.
0x1a460520045004e0054005f00550053004500R.E.N.T._.U.S.E.
0x1a47052005c00000000005c00530065007400R.\.....\.S.e.t.
⋯4 more rows
0x1a4c06f0063006100740069006f006e000000o.c.a.t.i.o.n...
0x1a4d05c0000000000000048004b0043005500\.......H.K.C.U.
0x1a4e05c0000000000000048004b004c004d00\.......H.K.L.M.
⋯7 more rows

Embedded absolute PDB path 0x1c46c–0x1c58c

⋯3 more rows
0x1c49cae83324baea8edda63826ae401000000..2K....c.j.....
0x1c4ac443a5c615c5f776f726b5c315c735c73D:\a\_work\1\s\s
0x1c4bc72635c72756e74696d655c6172746966rc\runtime\artif
0x1c4cc616374735c6f626a5c77696e2d61726dacts\obj\win-arm
0x1c4dc36342e52656c656173655c636f72656864.Release\coreh
0x1c4ec6f73745c617070686f73745c7374616eost\apphost\stan
0x1c4fc64616c6f6e655c617070686f73742e70dalone\apphost.p
0x1c50c64620000000000006900000069000000db......i...i...
0x1c51c00000000690000004743544c00100000....i...GCTL....
⋯7 more rows

Two or more embedded PE headers 0x22fa0–0x230e0

⋯5 more rows
0x22ff000000000000000000000000000000000................
0x230004d5a90000300000004000000ffff0000MZ..............
0x23010b8000000000000004000000000000000........@.......
0x2302000000000000000000000000000000000................
0x2303000000000000000000000000080000000................
⋯11 more rows

Showing the top 5 files — 6 more files (164 regions) not shown.

No evidence locations were recorded for this file. Raw result