Edit tour

Windows Analysis Report
T_AGM__1905.xml

Overview

General Information

Sample name:	T_AGM__1905.xml
Analysis ID:	1430762
MD5:	46ceb761adb7c723d89d267eb722e6e7
SHA1:	5d790d0e4dee292701e50ddce19b9750bb8c8cfc
SHA256:	7589b7da04afe02e535953f9ecbfeeb81422eda8fcff6a31d83beb21cd2e46af
Tags:	jar
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Potential browser exploit detected (process start blacklist hit)

Sigma detected: Use Short Name Path in Command Line

Classification

Process Tree

System is w10x64

MSOXMLED.EXE (PID: 7708 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\T_AGM__1905.xml" MD5: A2E6E2A1C125973A4967540FD08C9AF0)

iexplore.exe (PID: 7852 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\T_AGM__1905.xml MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 7912 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7852 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 7976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 8036 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7376 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,3537742655539462717,4247494418498581012,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 8016 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

msedge.exe (PID: 6876 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3616 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7852 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 7912, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 8016, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 7852, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 13.107.246.69 13.107.246.69
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 172.64.41.3 172.64.41.3

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.69

Source: global traffic	HTTP traffic detected: GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1714539437&P2=404&P3=2&P4=kVBY5XucgZSzbqI8oXPMOPFaYPQymIx3W%2bJzFDw74FbOzI8m4ZabeD483vK0wpOdnLAoocy2bPo4TO6vxQIO9w%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: yQRbHNvRyR1IPiowYUnZYvSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=AddressBar HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: AddressBarSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: 000003.log.10.dr, uu_host_config.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.10.dr, uu_host_config.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.10.dr, uu_host_config.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: msapplication.xml1.3.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xf4794dfb,0x01da9603</date><accdate>0xf4794dfb,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.3.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xf47e1298,0x01da9603</date><accdate>0xf47e1298,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.3.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xf48074e2,0x01da9603</date><accdate>0xf48074e2,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.googleusercontent.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: msapplication.xml.3.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.3.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.3.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.3.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.3.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.3.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.3.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.3.dr	String found in binary or memory: http://www.youtube.com/
Source: 94f19356-3775-4c71-ab56-92c65b80abf8.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: 000003.log.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\T_AGM__1905.xml"
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\T_AGM__1905.xml
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7852 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,3537742655539462717,4247494418498581012,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3616 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\T_AGM__1905.xml	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7852 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,3537742655539462717,4247494418498581012,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3616 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: appvisvsubsystems32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: c2r32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: ie_to_edge_stub.exe, 00000005.00000002.1357507552.0000022331013000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
chrome.cloudflare-dns.com	0%	Virustotal		Browse
sni1gl.wpc.nucdn.net	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.251.2.132	true	false		high
sni1gl.wpc.nucdn.net	152.195.19.97	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.246.69	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
142.251.2.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.nytimes.com/	msapplication.xml4.3.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.10.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
http://www.amazon.com/	msapplication.xml.3.dr	false		high
https://assets.msn.com	94f19356-3775-4c71-ab56-92c65b80abf8.tmp.11.dr	false		high
http://www.twitter.com/	msapplication.xml6.3.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.10.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json0.10.dr	false		high
https://drive.google.com/	manifest.json0.10.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.10.dr	false		high
http://www.youtube.com/	msapplication.xml8.3.dr	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
http://www.wikipedia.com/	msapplication.xml7.3.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
http://www.live.com/	msapplication.xml3.3.dr	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
http://www.reddit.com/	msapplication.xml5.3.dr	false		high
http://www.google.com/	msapplication.xml2.3.dr	false		high
https://drive-daily-3.corp.google.com/	manifest.json0.10.dr	false		high

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430762
Start date and time:	2024-04-24 06:56:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T_AGM__1905.xml
Detection:	CLEAN
Classification:	clean2.winXML@51/223@10/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xml Override analysis time to 240000 for current running targets taking high CPU consumption

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	zlONcFaXkc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	ShadowFury.exe	Get hash	malicious	Unknown	Browse
	ShadowFury.exe	Get hash	malicious	Unknown	Browse
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	UnderWars.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	http://rum.browser-intake-foxbusiness.com:443	Get hash	malicious	Unknown	Browse
	http://42.193.223.169/extensioncompabilitynode.exe	Get hash	malicious	Unknown	Browse
	https://d-wz.info/mygov	Get hash	malicious	HTMLPhisher	Browse
	https://www.longin-eki.co.jp.cduhzkc.cn/	Get hash	malicious	Unknown	Browse
	https://www.longin-eki.co.jp.nebxshr.cn/	Get hash	malicious	Unknown	Browse
	https://www.admin-longin.co.jp.mc3lva.cn/	Get hash	malicious	Unknown	Browse
	https://www.longin.co.jp.wiibhaq.cn/	Get hash	malicious	Unknown	Browse
	https://emv1.3rujia.cn/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
13.107.246.69	3Shape Unite Installer.exe	Get hash	malicious	Unknown	Browse
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse
	https://condoresorts.com/	Get hash	malicious	Unknown	Browse
	https://mota-engil.caf0sa.com/tiyamike.chikabadwa56078874fessdGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB097140964?5101245168264822=2215800694735574#dGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB0	Get hash	malicious	Unknown	Browse
	https://19apmic17.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse
	FFE Order details - Cincy v41720.xlsx	Get hash	malicious	Unknown	Browse
	https://pub-32bf4e9c1a1344aa8c0925c562b60fd3.r2.dev/index2.html	Get hash	malicious	HTMLPhisher	Browse
	https://ukrainerecordings.com/wp-includes/outfit/Office365/Office365/	Get hash	malicious	HTMLPhisher	Browse
	https://preview.webflow.com/preview/2024-project?utm_medium=preview_link&utm_source=designer&utm_content=2024-project&preview=2bf57169f6b59ecf9c01ab696f7c3560&workflow=preview	Get hash	malicious	HTMLPhisher	Browse
152.195.19.97	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	https://www.jottacloud.com/s/359ee8b110b8ca8464998842a5d227ed979	Get hash	malicious	HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=remoinmobiliaria.com%2F%40%2FAmericanautoshield/ZwgXU85423ZwgXU85423ZwgXU/bWlrZS5ub3ZpY2tAYW1lcmljYW5hdXRvc2hpZWxkLmNvbQ==	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://wisdomcircle.playbook.ai/cron/click-email/?eid=TmpVMVlXUTRORGM0TUdJMVl3PT0&ru=https://cd14fe4e.2690c0a545a7f22e8ae6844c.workers.dev/?qrc=caroline.picabea@naxicap.com%20https://wisdomcircle.playbook.ai/cron/click-email/?eid=TmpVMVlXUTRORGM0TUdJMVl3PT0&ru=https://cd14fe4e.2690c0a545a7f22e8ae6844c.workers.dev/?qrc=caroline.picabea@naxicap.com	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/o/s!BDwGtOL3Ob0ShA6L6a7ghGOEVOBw?e=-nVgacgL8k2GcXGT6ejjHg&at=9%22)%20and%20ContentType:(%221%22)	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://download-myproposal.xyz	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://cosantinexi.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FBigge/aDRmd79087aDRmd79087aDRmd/ZHN3ZWF6YUBiaWdnZS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FC2educate/aEFQv26188aEFQv26188aEFQv/anVsaWUubG9uZ2lub0BjMmVkdWNhdGUuY29t	Get hash	malicious	HTMLPhisher	Browse
	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse
172.64.41.3	zlONcFaXkc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	https://netorgft12232017-my.sharepoint.com:443/:f:/g/personal/lisa_imjts_com/EsnpAMoHQfhBluK8Y5tDE68BaHrT-12huxTJR_ZqVWR4tA?e=5%3aZZh3dZ&at=9	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	UnderWars.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	https://edbullardcompany-my.sharepoint.com/:f:/g/personal/eric_rosario_bullard_com/EoLKvcaqSE1Go3fA5to5CQABtxAftKTD0ktrakp7rbi4Xg?e=Mvbf0D	Get hash	malicious	HTMLPhisher	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse
	nsis-installer.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	New Order .doc	Get hash	malicious	Unknown	Browse	172.67.134.136
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
MICROSOFT-CORP-MSN-AS-BLOCKUS	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	13.107.213.69
	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.139.11
	3Shape Unite Installer.exe	Get hash	malicious	Unknown	Browse	40.67.232.186
	OHkRFujs2m.exe	Get hash	malicious	Unknown	Browse	104.208.16.94
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.213.69
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse	13.107.213.69
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.89.178.26
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://condoresorts.com/	Get hash	malicious	Unknown	Browse	13.107.246.69
CLOUDFLARENETUS	New Order .doc	Get hash	malicious	Unknown	Browse	172.67.134.136
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
EDGECASTUS	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	152.195.19.97
	https://magnisteel.lk/4765445b-32c6-49b0-83e6-1d93765276ca.php	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3D	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	192.229.211.108
	https://www.jottacloud.com/s/359ee8b110b8ca8464998842a5d227ed979	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://assets-usa.mkt.dynamics.com/6f8aa86c-81f8-ee11-a1fa-0022482e8338/digitalassets/standaloneforms/4b367e61-8601-ef11-a1fd-0022482f3701	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://divbracket.com	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2FscrHqwjeA3k&urlhash=dcQj&trk=public_profile-settings_topcard-website	Get hash	malicious	Unknown	Browse	152.199.24.163
	https://main-bvxea6i-qhygy63sspp2a.ca-1.platformsh.site/sample-page/	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58912
Entropy (8bit):	6.1047101308734
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynkHTa9CBS2qX7bJwgorQXdbiR3oM:z/0+zI7ynkTa9kS20vXdbe3
MD5:	3FD378E70E96FB6B31EFDB43EE80D121
SHA1:	EDDDBD6955BC0A181CB73AC1F7BE7975C01865E9
SHA-256:	121999886BD9F259084386E742CB8029A588DE2108E4BEDE2A2C0A035037EC9A
SHA-512:	11BEEA7FBACBE7716B61A91A4C5031ECBACD9BB565F5111C00937DE7BD9E919D98A29E33BA1223BC59BDDC35C337F0C352CE8851EAB6B6B6C71018CC70776E1F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17524
Entropy (8bit):	4.340063035506032
Encrypted:	false
SSDEEP:	192:wiuFhk5un5EpDdblzKaz+OJGbiIBJofNbr5/dn82/jqmo3qAi:rq25unWZd9dvJGiIBJoh387oAi
MD5:	03710426AB25AD1280E197F61249F9DE
SHA1:	F5E7A6FD42503AE4758BC36C8DD78D98EFB35047
SHA-256:	21E63F7C77896ED2B5F115957F2448E0A9E2DD738D7D487E471217421F6A93E1
SHA-512:	213CB55B8573335D1384AE704FF4267F224376056F71548660F9B2FDAA1203D8ABDDB787900AAF5D1E0AC6E5BE261F713BDBEFB67643D08E8D3672512A1AF588
Malicious:	false
Preview:	(function()..{.. var XHTML = "http://www.w3.org/1999/xhtml";.. .. // Time slicing constants.. var LIMIT = 10; // Maximum number of nodes to process before checking time.. var DURATION = 200; // Maximum amount of time (ms) to process before unblocking UI.. var DELAY = 15; // Amount of time (ms) to unblock UI.... // Tree building state.. var iterator;.. var nextNode;.. var root;.. var rootFirstChild;.. var time;.. .. // Template References.. var attrTemplate, attrName, attrValue;.. var elmStartTemplate, elmStartName;.. var elmEndTemplate, elmEndName;.. var cdataTemplate, cdataValue;.. var commentTemplate, commentValue;.. var style; .. .. // Only invoke this script if it was injected by our parser. Test for a condition that is.. // impossible for a markup to create - two direct children of the document... var secondRootElement = document.documentElement.nextElementSibling;.. if (secondRootElement == null

File type:	XML 1.0 document, ASCII text, with very long lines (35519)
Entropy (8bit):	5.767679335980501
TrID:	Generic XML (ASCII) (5005/1) 100.00%
File name:	T_AGM__1905.xml
File size:	2'858'660 bytes
MD5:	46ceb761adb7c723d89d267eb722e6e7
SHA1:	5d790d0e4dee292701e50ddce19b9750bb8c8cfc
SHA256:	7589b7da04afe02e535953f9ecbfeeb81422eda8fcff6a31d83beb21cd2e46af
SHA512:	a54c6f2fc817030e6efb3969015de613ab07328e5c4a360b7688771012055dcf07d0f67cde18dbcd314cdd15847c9f193cdfe013c3ee71789e4ecb2dda51be6a
SSDEEP:	12288:YxMCMDJ+ypUl5TZbSnBN3HVk/GbDxXhVhP9HcLVQwiC2Co6bdAVSoG54mQOGEGjR:YxMCs+Vb+B5S/gzc7o60y4mpXYo0/L
TLSH:	1AD5B50EBAF96CB6C374681C435DF8E6429E752F26E50C427445ABADCDE54FA2E0063C
File Content Preview:	<?xml version="1.0"?>.<NS5-DATA>.<INFO D="2024-04-23 02:14:42" F="55555" T="28" FD="256" TD="694" FN="1905" LLFN="1784" NS="6.5.32" DB="6.5.32" DBTYPE="Production" TZ="180"></INFO>.<GR C="187" D="240422191005" ID="2560000094055912"><T163 C="187" S="2" T="

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T_AGM__1905.xml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b815722-efde-4013-b60b-671b111e46b7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\638c0bbd-2eba-4135-ac85-fe672908091d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e4961c7-fc78-4202-8885-653549aaf70b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\88a59655-2f3a-40eb-a683-2f81a58920d3.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8cf680eb-d7d6-407f-933e-ac6ee0890438.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\93a1b75b-8bd6-46ca-9af4-38d0ace49367.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\5a153eb8-c213-4b57-a1da-904368c80bf6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66289128-1F64.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66289129-1ADC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\02d1e43e-f414-429f-beee-81d15da555a0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4d5b34ef-d00e-46e2-b37c-1e37070d8216.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\69268410-7a89-4a58-8319-fb8893c3d721.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\75670973-4241-450c-8833-b55e9511577d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\83c7fc50-e58f-40ff-8c20-8c0c51dc268f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\89666eda-7e1e-4d99-9f37-0697adb4030e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\89fae672-0322-49d4-bd08-d9de31146260.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF4d619.TMP (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Windows Analysis Report
T_AGM__1905.xml

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 06:57:16.640254974 CEST	49548	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:16.640558958 CEST	49321	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:16.793806076 CEST	53	49321	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:16.793829918 CEST	53	49548	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:20.018158913 CEST	61529	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:20.018419981 CEST	62201	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:20.018846035 CEST	65057	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:20.018955946 CEST	65211	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:20.047477007 CEST	53140	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:20.047640085 CEST	53055	53	192.168.2.9	1.1.1.1
Apr 24, 2024 06:57:20.171842098 CEST	53	62201	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:20.172091007 CEST	53	61529	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:20.172301054 CEST	53	65057	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:20.173451900 CEST	53	65211	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:20.201098919 CEST	53	53140	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:20.201337099 CEST	53	53055	1.1.1.1	192.168.2.9
Apr 24, 2024 06:57:21.600349903 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.755009890 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.755182981 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.755198002 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.756751060 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.757199049 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.757368088 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.757863045 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.757965088 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.910672903 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.910692930 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.910746098 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.910765886 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.910820007 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.911876917 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.912081957 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:21.912185907 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.913203001 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.913825989 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:21.919523954 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:22.065197945 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:22.107391119 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:23.162977934 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:23.163532019 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:23.168967962 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.317014933 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:23.317727089 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:23.317826033 CEST	443	58750	172.64.41.3	192.168.2.9
Apr 24, 2024 06:57:23.318070889 CEST	58750	443	192.168.2.9	172.64.41.3
Apr 24, 2024 06:57:23.322904110 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.323843956 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.324115038 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.324129105 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.324706078 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.325757980 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.325865984 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.326184988 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.326298952 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.479226112 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.479249001 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.479260921 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.479271889 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.479799032 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.479861975 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.481270075 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.482793093 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.482837915 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.483194113 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 06:57:23.633232117 CEST	443	55162	162.159.61.3	192.168.2.9
Apr 24, 2024 06:57:23.696938038 CEST	55162	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.181540966 CEST	49266	53	192.168.2.9	1.1.1.1
Apr 24, 2024 07:00:14.181689024 CEST	58649	53	192.168.2.9	1.1.1.1
Apr 24, 2024 07:00:14.335669041 CEST	53	49266	1.1.1.1	192.168.2.9
Apr 24, 2024 07:00:14.335695028 CEST	53	58649	1.1.1.1	192.168.2.9
Apr 24, 2024 07:00:14.337553978 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.337750912 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.338011980 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.338114977 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.492592096 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.493634939 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.493693113 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.493827105 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.493866920 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.494187117 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.494488955 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.494709969 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.494854927 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.495007992 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.495080948 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.508337975 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:14.647435904 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.647777081 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:14.647999048 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:15.180790901 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:15.180891991 CEST	52692	443	192.168.2.9	162.159.61.3
Apr 24, 2024 07:00:15.335201979 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:15.336695910 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:15.337291956 CEST	443	52692	162.159.61.3	192.168.2.9
Apr 24, 2024 07:00:15.337682009 CEST	52692	443	192.168.2.9	162.159.61.3

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:57:17 UTC	580	OUT	GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-24 04:57:17 UTC	565	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPo2-V4lhx-W63GzLJn6NxO_0IMSY1--mxf6UfpAIrrBS81DJnIlwmra5z4e7r-VbgWREQ Accept-Ranges: bytes Content-Length: 139091 X-Goog-Hash: crc32c=H9/qeQ== Server: UploadServer Date: Tue, 23 Apr 2024 18:32:03 GMT Expires: Wed, 23 Apr 2025 18:32:03 GMT Cache-Control: public, max-age=31536000 Age: 37514 Last-Modified: Thu, 18 Apr 2024 18:31:51 GMT ETag: 82b50a01_49fb4719_dae394b7_fbc972d4_42d9e512 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 04:57:17 UTC	690	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 22 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr24"0"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: d2 9f 7a 6c 80 d0 71 98 9f 7a 7b 13 b7 05 9c d7 02 20 17 3b cc 01 6f 51 2a 66 e2 83 e7 11 83 e2 b3 53 9d d5 24 e1 bb 2f bc cc d3 09 89 36 87 72 b7 81 22 82 40 1f 8b 08 00 00 00 00 00 00 ff bd 7c 5b 73 ab 3a ba ed 5f d9 b5 9e 77 57 21 30 5e d3 fb 6d 12 10 98 58 22 08 5d 40 bb 76 75 01 22 c1 20 30 89 49 8c e9 ea ff 7e 94 d5 bd bb eb 74 f5 74 d9 0f e7 bc 64 c6 99 dc 86 be cb 18 43 42 fe ef bf fc a6 9a 73 fd 71 9c e6 e3 69 fc ed bf 7e 9b 3f 9a a6 2d cf ed 7f 4c cd c7 7f bc 1e 75 f3 db 7f fe 76 3e be 8d 8d fa 73 7d 1a e7 66 9c 7f fb af bf fc 36 95 57 7d 2a 95 39 be b9 c6 5d 65 bb 96 14 ae 95 db 6d 5b db ad ae af fb ad 70 ce c7 62 58 be 0a 7b 7e ad 6d bd 95 d9 7e 8b fd 9f 2e 3e 5e 8e 32 d4 a3 cc b1 b5 ef 4e 47 73 7c 8b 3a 66 ef bf ff 3e e8 b3 cc d1 31 d1 f3 ef Data Ascii: zlqz{ ;oQfS$/6r"@\|[s:_wW!0^mX"]@vu" 0I~ttdCBsqi~?-Luv>s}f6W}9]em[pbX{~m~.>^2NGs\|:f>1
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: 05 ba ab f8 8e ca 80 f7 32 52 2b 03 d0 13 e3 cf 4d f9 00 3e 34 b8 61 1d 10 8b 73 6c ba 88 f7 42 2d b0 52 b8 2b a5 b5 40 c3 39 ef a9 e5 3e 15 54 43 c1 76 09 f5 25 64 0c 5d 69 80 5f 93 a7 5f e2 eb ef cd cf 2a b0 56 93 eb 52 39 38 af 35 44 86 eb 7b ca dc b2 0e 6b a0 68 61 d7 a2 5f 98 03 73 66 e3 58 69 b2 f0 20 06 a2 77 ed 47 f8 4f 59 f3 35 63 3a e1 63 60 25 7c fa 6c a8 9a 2b 4e 26 9e c7 7b 11 c6 8e 61 f3 98 84 81 9b 09 09 38 9b 7c c4 0c ff d9 e0 49 fe ba bf f4 f7 f2 43 96 f3 43 6a eb 57 d4 a9 4f 02 e1 8b 64 b0 cd 34 06 69 cf 0f 89 88 e3 72 fd 39 13 a3 33 aa 70 3e f0 4e b5 88 f2 57 66 13 fa 48 7f 91 9d 89 d9 1f 39 02 bb 0c ea d0 e8 bc c8 5c 7f 83 6d f8 82 87 d3 86 6b 7e a6 91 d7 97 ce 4f 5b f8 e4 54 db e9 a2 56 cd 6e c4 4f 57 4f f7 e1 2b ec 1f 57 9a cb 82 08 Data Ascii: 2R+M>4aslB-R+@9>TCv%d]i__*VR985D{kha_sfXi wGOY5c:c`%\|l+N&{a8\|ICCjWOd4ir93p>NWfH9\mk~O[TVnOWO+W
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: eb 1f bd 89 14 2b 5f 64 de 8e 48 13 1b 5b 96 c3 38 2c 55 80 c3 ca 87 69 19 61 82 74 e0 a8 a1 7d 22 01 e4 88 c5 a4 36 e3 4f 2c f5 b5 1f ad f3 f7 7c 6e 21 dc af 6a d0 df fd ed f5 8f 71 d4 bb 7f bd c7 45 f8 4a fe d1 23 3b 49 ea d1 3b 55 d6 4e b3 2e 0e a5 e3 71 93 fb 56 aa a5 2d ad f8 a5 c9 c0 0b e6 ed 67 b9 7a 1f c4 9a e3 3f fa 7e 08 ad 3f c6 49 ef ce 95 6d c6 31 34 78 6c 79 bd 13 5f d9 04 3f ae 15 8d 5d 29 14 4a 33 e0 d7 3e 3c 48 1d e7 e9 70 71 48 f0 e6 64 39 0c 59 a0 58 9a c7 8e c9 87 27 33 1e 1c 51 cf 79 00 5f 60 7c c9 95 33 f5 22 81 d7 a9 3e 0e 8a 4e 85 5c b7 af 55 e4 1d 13 fa d3 35 bc bf 6d b8 7e 42 81 e9 a3 0c cd ca 99 82 1a 78 e3 2d 7c b9 85 bd 3b 31 5e 71 a8 bb 2c e4 96 1a e6 8f 92 ab bd a9 11 64 3c dc 13 1e d4 58 e8 36 2c b5 ce eb 30 ee 89 6e 33 a3 Data Ascii: +_dH[8,Uiat}"6O,\|n!jqEJ#;I;UN.qV-gz?~?Im14xly_?])J3><HpqHd9YX'3Qy_`\|3">N\U5m~Bx-\|;1^q,d<X6,0n3
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: 24 0f c4 6f bf c9 84 12 25 e3 a7 2c 57 5b c4 c0 20 2d 45 58 0f a3 ca e8 6d 31 92 8c 53 e2 24 21 08 70 de 5e 1a bd df 30 3b e6 bc 87 eb af f1 cd f7 e2 c3 99 00 48 75 30 4a 28 94 68 9c ce b9 e1 5b 12 29 29 99 75 a1 02 be 18 8d d6 19 3d 3b 19 7f 56 c8 11 b9 68 44 a0 1a b5 7c 20 7e 16 77 8c f7 08 71 8e c3 e9 9d 0c 1c 16 b6 de 53 d0 9e d4 88 9c 32 df cf 3c e4 a0 ee 02 53 ff 72 e6 86 0b f1 8a 1c 25 da af 1b f8 3e ee c4 27 32 8a a3 86 d7 56 13 ee f2 66 98 84 a9 7b 61 ea 64 6c 46 1c 63 e7 34 e3 41 bf d2 bc a5 8c 81 23 b3 c1 49 68 a5 a9 23 1f e1 87 4d a3 09 16 14 53 b2 b6 2b 8a da 77 2c 60 57 db 1b 97 32 ee a1 60 72 08 d3 59 1d 71 8b 83 bd 23 fd c0 f8 cf 5d 81 47 7e c3 23 cd f3 9d f8 2e 65 a0 d2 d4 ae 57 d3 c3 75 da b5 9e d4 6c 83 72 69 31 5f 71 16 2e 8c 74 9a a1 Data Ascii: $o%,W[ -EXm1S$!p^0;Hu0J(h[))u=;VhD\| ~wqS2<Sr%>'2Vf{adlFc4A#Ih#MS+w,`W2`rYq#]G~#.eWulri1_q.t
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: 55 a7 4f 68 b0 1e e0 bf 78 9b 0d a0 6b 60 60 d5 3c 6e 79 88 fb 82 42 88 46 78 ce 18 36 de d3 b8 7a a7 be d4 c3 8f b9 19 63 a0 42 b8 25 3e 27 d8 de dd 98 df 75 ef ec 9f 7b 5b e4 6d 97 db da 38 32 cb dc 9f bc 57 fd c9 28 24 93 35 c1 65 31 7d e6 50 41 cf 78 b6 b8 c8 2d fe 52 0a fd 8a 38 3e 28 30 3d d0 5f f6 cb 81 15 97 34 df bb df ef b8 96 3e d6 d2 6f b3 8a b9 2d ea 27 50 c1 f8 50 31 b8 a7 91 1c b8 43 a0 f1 fa 22 e3 de 36 1d e0 2d 7c f7 ea 97 f5 90 4f 93 e4 13 c1 d6 8c 4b ad 85 cc 75 64 72 71 5b 05 3f dc 03 8d 2f ca 78 11 02 15 47 0c ef 8d 37 34 7d 88 0c 12 c6 8f e0 9b 0b 47 2d 19 35 fc 6a 69 ca 73 7c 96 83 bb 64 fd e4 d4 9d e1 27 aa 58 22 f0 47 ed 90 01 33 bd 94 39 b4 aa b0 b6 89 86 bf 9e df 75 bc 7b fd 1f 48 d8 c6 65 22 1e a4 d8 03 0a f8 3b ee a7 c0 68 c5 Data Ascii: UOhxk``<nyBFx6zcB%>'u{[m82W($5e1}PAx-R8>(0=_4>o-'PP1C"6-\|OKudrq[?/xG74}G-5jis\|d'X"G39u{He";h
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: 01 47 06 6e 54 b1 78 cb 05 79 49 c2 02 c8 f0 87 25 60 7c 92 06 5b da ab 77 e4 fc 7c c4 47 8c 46 bf ba 05 6d c3 26 dc 09 14 f1 d7 74 84 a6 6f bb 76 c1 77 9f 32 a8 2f 28 24 56 06 a6 89 da b8 54 bc 7d 26 ab c4 e6 99 7e 3d 8f ed 90 7b 75 68 6a 9e 7f 29 ba fd a2 20 e7 b5 19 d3 0c f2 e7 7a 65 6e 39 a8 b4 f1 c9 d1 f4 1d 5c 07 cb 4c 06 d7 4d 7b 6e 1c f9 0e 48 2e 1f e2 07 62 3c ca 81 ed 4a 1e c1 59 86 6a ce a0 7c 3a f0 dd ca 23 d2 f1 91 6c 69 38 9f 8a 15 1f 8a b5 cd 89 75 71 0a dd 2e e5 9a de e8 2f e4 5e 1f f8 61 6a ea 50 8a f9 42 c7 e2 62 3c 4c 90 6a 7c 12 42 5e 6b 0e 23 bc f2 0b e9 7f ac c2 f7 5c e4 78 4c d9 46 0f 84 f0 ab 84 d3 03 f3 d8 f1 98 50 e4 10 c7 cb 14 53 ba 61 f3 73 39 40 50 45 53 51 e6 38 26 be 1e 90 c6 25 86 8a e0 3c b8 a0 d5 db 70 7b 9a ab 48 ff 7a Data Ascii: GnTxyI%`\|[w\|GFm&tovw2/($VT}&~={uhj) zen9\LM{nH.b<JYj\|:#li8uq./^ajPBb<Lj\|B^k#\xLFPSas9@PESQ8&%<p{Hz
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: 31 96 3d 7f 02 23 a6 86 1b fb 5d f7 af 71 34 7a 60 a8 6d 7c 35 5e fd 53 86 bb 4e 09 a0 ab 91 bc 56 86 48 ab a3 c1 7e fd 77 fb 17 e2 05 85 aa e0 d0 68 44 c8 e7 cc 68 8c 03 d3 8c 85 64 4b 06 f9 29 f3 e9 bd b2 e4 33 13 e4 15 1b 5d c2 8d ce 32 79 f7 55 8b bf ef 3f f9 e7 38 5f be f7 63 e5 b6 c9 9b 81 f7 b9 f3 3d 06 fa f2 c7 98 ff bb fb 0e 68 a6 96 7e a7 86 87 71 c0 9f 0b e0 d1 03 73 f7 55 ee b9 c6 3b 69 d6 63 8f 44 6c ad 46 6c 08 b4 58 88 ff d3 c9 78 dc e5 ff bb 6f e9 9f f7 5d 65 1e db a5 c0 3a 77 d4 57 3d cc ba d6 bb 63 29 4c 3e 45 f1 97 fc e5 fd 77 83 39 27 ca 81 f1 92 5d 6b fc 56 0c a9 38 bb a5 15 6f 32 d6 26 28 2f ec 84 b5 a7 2c 04 25 07 4a 23 a3 fd ca b5 b6 ab ee ed f8 ca ad f3 7e 90 e6 5e 46 0b fe 6d ff c9 f7 98 ff 2d 97 4c 6e fd 71 0f b8 3b 7e ef e9 2a Data Ascii: 1=#]q4z`m\|5^SNVH~whDhdK)3]2yU?8_c=h~qsU;icDlFlXxo]e:wW=c)L>Ew9']kV8o2&(/,%J#~^Fm-Lnq;~*
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: 76 d5 ab f1 d4 d9 78 ea 7c 3c f5 72 3c f5 f5 78 ea 9b f1 d4 ab 31 d4 10 a1 9c ea 08 6a ca a2 d5 ae 7d 86 ba 42 6e 80 68 75 4a da bb e1 e8 a5 d1 a1 f1 22 aa af 20 14 89 3d 01 df a3 ce 40 48 ef 8c b6 b8 56 cb ec a3 68 81 ad 8e 8d 95 40 f6 c8 dc f1 e0 8d 96 bb e2 2d b8 c7 12 f5 e0 01 f9 a9 d8 54 46 1d 72 95 a2 9c 5c 24 30 eb 8b b7 13 df dc 82 3c 86 8a 61 15 ac 45 6f 32 37 5e 0a 03 b4 15 1c ff b6 64 a5 34 a8 a0 30 e1 9c 7f 5e 7e e2 d8 eb 23 e2 9c 13 83 1a 47 27 8c d9 71 9c cf a1 bc 68 8a c8 7f bf ff 8b 7e 27 3f 75 3e 65 7e ee fa bf 35 00 25 48 cb 41 65 cf 66 f3 05 f9 10 7f ea e0 da e2 5e 2b 9c 5e 03 76 dc 40 4c 83 4f 2f 09 d6 4e db de 72 d9 45 6f e1 a8 c8 16 0b 6a e9 84 85 13 4b 7f 41 60 b0 f4 f9 e8 c2 88 68 13 55 d2 43 1c 9f 8b 28 62 7e bd c6 b8 00 b8 32 f5 Data Ascii: vx\|<r<x1j}BnhuJ" =@HVh@-TFr\$0<aEo27^d40^~#G'qh~'?u>e~5%HAef^+^v@LO/NrEojKA`hUC(b~2
2024-04-24 04:57:17 UTC	1255	IN	Data Raw: b3 a5 0a 7f b3 78 7a 9c 1c a7 27 27 91 4d cc d4 d6 05 cc 34 af 37 f4 5b b3 00 80 c8 84 b3 d6 ab 9b 61 ef 2a 01 e6 40 a6 e4 36 05 c4 0e 96 9a 94 59 bb 96 4b 52 f6 6b c4 2f e6 5d a0 72 ec b8 02 f6 93 b8 9e 33 2c 0d 69 34 94 31 67 16 47 61 80 1b 3f 62 66 50 b8 cf 04 8d 10 1f 12 d3 80 2e 71 66 38 8b 77 36 12 b4 3d 33 70 12 43 db dc ac 0c 71 73 73 75 d4 11 11 22 85 86 ad 94 95 25 b4 8d 6f bd d1 d9 30 e1 53 43 4e 15 29 91 a5 25 28 70 26 cb c8 a6 8b 62 63 c0 eb a6 a7 f7 f3 a8 41 3d c2 4a 34 c6 d3 06 61 c9 e1 e0 1b 47 42 a9 27 35 60 12 cb 37 7c 66 53 0c 2a 1d 20 f4 71 da 06 b9 01 b5 8e 4f a2 0d 3f 01 d2 89 63 f1 83 a0 85 9c 32 0a 60 a3 9e cd fa 7e 22 78 53 00 7b 25 35 ab 8a 75 4f af 62 a1 29 50 d1 39 ef 39 bf ba 6b 68 1c 88 09 89 c1 c0 98 d9 94 2a 59 86 df 58 74 Data Ascii: xz''M47[a@6YKRk/]r3,i41gGa?bfP.qf8w6=3pCqssu"%o0SCN)%(p&bcA=J4aGB'5`7\|fS qO?c2`~"xS{%5uOb)P99kh*YXt

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:57:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-24 04:57:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-24 04:57:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 24 Apr 2024 04:57:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 87938311ccc80ad9-LAS alt-svc: h3=":443"; ma=86400
2024-04-24 04:57:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 02 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#^)

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:57:21 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-24 04:57:21 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-24 04:57:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 24 Apr 2024 04:57:21 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8793831578cb09f9-LAS alt-svc: h3=":443"; ma=86400
2024-04-24 04:57:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 02 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:57:22 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1714539437&P2=404&P3=2&P4=kVBY5XucgZSzbqI8oXPMOPFaYPQymIx3W%2bJzFDw74FbOzI8m4ZabeD483vK0wpOdnLAoocy2bPo4TO6vxQIO9w%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: yQRbHNvRyR1IPiowYUnZYv Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-24 04:57:22 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2651395 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 24 Apr 2024 04:57:22 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 85b1e032-fe38-4340-aae6-56a69bbd869b MS-CV: r2zNKFAig7Iv/pcatn3sa1.0 MS-RequestId: 3e56e8fe-67e8-4bc3-894a-1119d936dd99 Server: ECAcc (lac/558D) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-04-24 04:57:22 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:00:15 UTC	601	OUT	GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=AddressBar HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: AddressBar Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-24 05:00:16 UTC	632	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:00:16 GMT Content-Type: application/octet-stream Content-Length: 403024 Connection: close Content-MD5: j5vaSFhUqCPiC0fEiXk3zw== Last-Modified: Thu, 19 Oct 2023 17:36:16 GMT ETag: "0x8DBD0C9E5CD1B3B" x-ms-request-id: e6ba21d0-801e-0076-5b04-96ecbb000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-azure-ref: 20240424T050016Z-168bb8d798b8mfsfabysh5aa5n000000036g00000000ssrd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-24 05:00:16 UTC	15752	IN	Data Raw: 7b 0d 0a 20 20 20 20 22 30 31 32 33 6d 6f 76 69 65 73 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 39 38 33 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 39 34 38 2c 20 31 31 30 36 2c 20 39 39 37 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 31 30 32 30 33 39 38 2e 61 70 70 2e 6e 65 74 73 75 69 74 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 32 32 38 2c 20 32 33 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 31 33 33 37 78 2e 74 6f 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 39 38 33 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 36 35 37 2c 20 34 37 35 2c 20 34 30 36 38 5d 7d 22 2c 0d 0a 20 20 20 20 Data Ascii: { "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}", "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}", "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",
2024-04-24 05:00:16 UTC	16384	IN	Data Raw: 3a 20 5b 37 36 37 30 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 33 35 30 33 2c 20 31 32 34 30 2c 20 35 38 34 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 65 6e 74 75 72 79 2e 74 65 63 68 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 31 30 36 2c 20 35 32 30 33 2c 20 38 34 36 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 68 65 63 6b 65 64 73 61 66 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 2c 20 33 39 37 39 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 31 30 36 2c 20 32 31 38 39 2c 20 38 34 36 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 6c 65 61 72 73 63 6f 72 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 Data Ascii: : [7670, 6061], \"Tier2\": [3503, 1240, 5840]}", "app.century.tech": "{\"Tier1\": [6061], \"Tier2\": [5106, 5203, 8469]}", "app.checkedsafe.com": "{\"Tier1\": [6061, 8405, 3979], \"Tier2\": [5106, 2189, 8469]}", "app.clearscore.com": "{\"Ti
2024-04-24 05:00:16 UTC	16384	IN	Data Raw: 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 31 32 39 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 31 36 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 6f 72 6b 61 2e 61 70 70 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 32 31 34 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 37 39 37 2c 20 38 34 36 39 2c 20 38 31 32 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 73 2e 68 61 74 63 68 6c 69 6e 67 73 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 39 31 33 32 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 34 34 34 2c 20 39 32 34 34 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 73 30 35 39 2e 68 6f 73 74 63 6f 6d 6d 73 65 72 76 65 72 73 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c Data Ascii: \"Tier1\": [6129], \"Tier2\": [166]}", "aworka.app": "{\"Tier1\": [214, 6061], \"Tier2\": [8797, 8469, 8129]}", "aws.hatchlings.com": "{\"Tier1\": [9132, 6061], \"Tier2\": [5444, 9244]}", "aws059.hostcommservers.co.uk": "{\"Tier1\": [6061],
2024-04-24 05:00:16 UTC	16384	IN	Data Raw: 39 32 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 72 70 6f 72 74 32 2e 63 61 72 6c 79 6c 65 66 69 6e 61 6e 63 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 32 33 34 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 32 31 39 2c 20 32 37 35 31 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 72 74 2e 65 62 61 79 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 38 31 38 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 33 39 39 2c 20 39 34 39 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 72 74 2e 70 61 79 6d 65 6e 74 73 2e 65 62 61 79 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 38 31 38 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 33 39 39 2c 20 39 Data Ascii: 928]}", "carport2.carlylefinance.com": "{\"Tier1\": [7234, 8405], \"Tier2\": [6219, 2751]}", "cart.ebay.co.uk": "{\"Tier1\": [7818, 8405], \"Tier2\": [7399, 9497]}", "cart.payments.ebay.co.uk": "{\"Tier1\": [7818, 8405], \"Tier2\": [7399, 9
2024-04-24 05:00:16 UTC	16384	IN	Data Raw: 20 38 37 38 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 65 64 69 74 67 61 74 65 77 61 79 2e 62 61 72 63 6c 61 79 73 77 65 61 6c 74 68 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 32 31 39 2c 20 32 33 36 37 2c 20 36 33 31 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 65 65 64 61 69 6c 65 65 6e 62 6f 69 6c 65 72 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 31 31 33 34 2c 20 31 39 31 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 6a 70 67 61 74 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 39 33 34 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 6d Data Ascii: 8783]}", "creditgateway.barclayswealth.net": "{\"Tier1\": [8405], \"Tier2\": [6219, 2367, 6318]}", "creedaileenboiler.com": "{\"Tier1\": [6061], \"Tier2\": [1134, 1912]}", "crjpgate.com": "{\"Tier1\": [6061], \"Tier2\": [9934]}", "crm
2024-04-24 05:00:17 UTC	16384	IN	Data Raw: 69 65 72 32 5c 22 3a 20 5b 36 37 36 2c 20 31 31 30 36 2c 20 36 33 38 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 63 67 2e 66 61 2e 65 6d 32 2e 6f 72 61 63 6c 65 63 6c 6f 75 64 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 31 35 32 2c 20 32 33 36 2c 20 34 39 31 35 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 65 61 72 6e 2e 72 75 6e 73 68 61 77 2e 61 63 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 2c 20 36 30 36 31 2c 20 38 38 34 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 38 31 32 2c 20 31 32 34 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 65 61 72 6e 69 6e 67 2e 6e 6f 6f 64 6c 65 6e 6f 77 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b Data Ascii: ier2\": [676, 1106, 6380]}", "elcg.fa.em2.oraclecloud.com": "{\"Tier1\": [6061], \"Tier2\": [6152, 236, 4915]}", "elearn.runshaw.ac.uk": "{\"Tier1\": [7670, 6061, 8845], \"Tier2\": [8812, 1240]}", "elearning.noodlenow.co.uk": "{\"Tier1\": [
2024-04-24 05:00:17 UTC	16384	IN	Data Raw: 35 34 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 34 73 79 65 74 69 2e 63 6f 67 6e 69 73 6f 66 74 2e 63 6c 6f 75 64 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 32 33 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 64 67 65 74 73 62 6f 6f 6d 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 35 37 35 2c 20 33 39 35 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 6c 6c 65 72 69 65 73 2e 70 61 72 65 6e 74 73 64 6f 6d 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 38 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 6d 65 2e 67 72 61 6e 62 6c 75 65 66 61 6e 74 61 73 Data Ascii: 547]}", "g4syeti.cognisoft.cloud": "{\"Tier1\": [6061], \"Tier2\": [236]}", "gadgetsboom.net": "{\"Tier1\": [6061, 8405], \"Tier2\": [8575, 3952]}", "galleries.parentsdome.com": "{\"Tier1\": [], \"Tier2\": [786]}", "game.granbluefantas
2024-04-24 05:00:17 UTC	16384	IN	Data Raw: 54 69 65 72 31 5c 22 3a 20 5b 35 36 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 36 37 33 2c 20 36 30 32 30 2c 20 35 36 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 63 74 2e 68 61 74 74 6f 6e 61 63 61 64 65 6d 79 2e 6f 72 67 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 36 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 63 74 70 6f 72 74 61 6c 2e 63 79 6d 72 75 2e 6e 68 73 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 31 34 38 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 64 2e 61 74 6c 61 73 73 69 61 6e 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 Data Ascii: Tier1\": [568], \"Tier2\": [9673, 6020, 568]}", "ict.hattonacademy.org.uk": "{\"Tier1\": [7670], \"Tier2\": [960]}", "ictportal.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": []}", "id.atlassian.com": "{\"Tier1\": [6061, 5938], \"Tier2
2024-04-24 05:00:17 UTC	16384	IN	Data Raw: 20 5b 37 36 37 30 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 31 38 33 2c 20 31 32 34 30 2c 20 33 35 30 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 64 72 61 70 74 69 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 39 38 33 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 38 33 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 65 64 73 2e 63 64 70 73 6f 66 74 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 35 36 38 2c 20 35 39 32 2c 20 31 31 32 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 74 75 73 6b 6e 6f 77 2e 66 6f 63 75 73 76 69 73 69 6f 6e 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 5d 2c 20 5c 22 54 69 65 72 32 5c 22 Data Ascii: [7670], \"Tier2\": [6183, 1240, 3503]}", "ledrapti.net": "{\"Tier1\": [6061, 983], \"Tier2\": [7838]}", "leeds.cdpsoft.com": "{\"Tier1\": [8405, 6061], \"Tier2\": [4568, 592, 1129]}", "letusknow.focusvision.com": "{\"Tier1\": [], \"Tier2\"
2024-04-24 05:00:17 UTC	16384	IN	Data Raw: 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 34 36 30 2c 20 33 37 39 2c 20 39 38 34 2c 20 35 34 30 31 2c 20 38 39 39 30 2c 20 36 31 30 31 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 64 78 2e 6d 72 6f 6f 6d 73 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 39 39 38 2c 20 37 35 38 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 65 2e 73 75 6d 75 70 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 33 32 37 31 2c 20 33 33 38 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 65 64 2e 65 74 6f 72 6f 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 Data Ascii: : [6061, 8405], \"Tier2\": [5460, 379, 984, 5401, 8990, 6101]}", "mdx.mrooms.net": "{\"Tier1\": [7670, 5938], \"Tier2\": [8998, 7583]}", "me.sumup.com": "{\"Tier1\": [6061, 8405], \"Tier2\": [3271, 3387]}", "med.etoro.com": "{\"Tier1\": [84

Target ID:	0
Start time:	06:57:09
Start date:	24/04/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\T_AGM__1905.xml"
Imagebase:	0xc0000
File size:	225'176 bytes
MD5 hash:	A2E6E2A1C125973A4967540FD08C9AF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	06:57:11
Start date:	24/04/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\T_AGM__1905.xml
Imagebase:	0x7ff6c0c20000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	06:57:12
Start date:	24/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	11
Start time:	06:57:13
Start date:	24/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false